fix: power buttons via systemctl, single greeter window (v0.8.7)

Reboot/shutdown buttons always failed: power.rs called `loginctl
reboot|poweroff`, but loginctl has no such verbs (systemd 260) — those
belong to systemctl. moonlock/moonset already used systemctl; moongreet
was the outlier. Switch to `systemctl --no-ask-password reboot|poweroff`.

The multi-monitor greeter gave Exclusive keyboard only to the first
monitor's window, so a user focused on any other output could not type
the password. Drop the per-monitor loop + hotplug; create one window on
the focused output (no set_monitor) with Exclusive keyboard.

Polkit rule kept as a harmless safety net (it was never the blocker;
CanReboot returns yes). The missing journal errors were not a logging
bug — they were lost to a hard power-cut before journald synced.

config/polkit/50-moongreet-power.rules

@@ -1,5 +1,5 @@
 // ABOUTME: Allow the greeter user to reboot and power off without authentication.
-// ABOUTME: Required because greetd's greeter session is inactive in logind.
+// ABOUTME: Safety net for the agent-less greeter session — no askpass/polkit agent to answer a challenge.
 
 polkit.addRule(function(action, subject) {
     if (subject.user === "greeter" &&