fix+perf: audit fixes and GPU blur migration (v0.5.0)

Address all findings from quality, performance, and security audits:
- Filter greetd error descriptions consistently (security)
- Re-enable power buttons after failed action (UX bug)
- Narrow TOCTOU window in avatar loading via symlink_metadata (security)
- Allow @ in usernames for LDAP compatibility
- Eliminate unnecessary Vec allocation in passwd parsing
- Remove dead i18n field, annotate retained-for-future struct fields
- Fix if/if→if/else and noisy test output in power.rs

Replace CPU blur (image crate + disk cache + async orchestration) with
GPU blur via GskBlurNode — symmetric with moonlock and moonset.
Removes ~15 transitive dependencies and ~200 lines of caching code.

src/users.rs

@@ -23,9 +23,11 @@ const NOLOGIN_SHELLS: &[&str] = &[
 #[derive(Debug, Clone)]
 pub struct User {
     pub username: String,
+    #[allow(dead_code)] // Retained for debugging and future UID-based features
     pub uid: u32,
     pub gecos: String,
     pub home: PathBuf,
+    #[allow(dead_code)] // Retained for debugging and future shell-based filtering
     pub shell: String,
 }
 
@@ -55,16 +57,13 @@ pub fn get_users(passwd_path: Option<&Path>) -> Vec<User> {
     let mut users = Vec::new();
 
     for line in content.lines() {
-        let parts: Vec<&str> = line.split(':').collect();
-        if parts.len() < 7 {
+        let mut fields = line.splitn(7, ':');
+        let (Some(username), Some(_pw), Some(uid_str), Some(_gid), Some(gecos), Some(home), Some(shell)) =
+            (fields.next(), fields.next(), fields.next(), fields.next(),
+             fields.next(), fields.next(), fields.next())
+        else {
             continue;
-        }
-
-        let username = parts[0];
-        let uid_str = parts[2];
-        let gecos = parts[4];
-        let home = parts[5];
-        let shell = parts[6];
+        };
 
         let uid = match uid_str.parse::<u32>() {
             Ok(u) => u,