fix: security hardening, blur geometry, and performance audit fixes (v0.6.2)

Security: cache dirs now 0o700 via DirBuilder::mode(), blur config
validated (finite + clamp 0–200), TOCTOU socket pre-check removed.

Quality: GPU blur geometry fixed (texture shifted instead of stretched),
is_valid_username hardened, is_valid_gtk_theme extracted as testable fn,
save_last_session error handling consistent with save_last_user.

Performance: blurred texture cached across monitors (1x GPU renderpass
instead of N), FingerprintProbe device proxy cached in GreeterState with
generation counter to prevent race condition on fast user-switch.

Clippy: all 7 warnings resolved (collapsible if-let, redundant closure,
manual_range_contains, too_many_arguments suppressed for GTK widget fns).

Tests: 109 → 118 (GTK theme validation, Unicode usernames, cache dir
permissions, unwritable dir handling, blur config edge cases).

src/sessions.rs

@@ -36,14 +36,14 @@ fn parse_desktop_file(path: &Path, session_type: &str) -> Option<Session> {
             continue;
         }
 
-        if let Some(value) = line.strip_prefix("Name=") {
-            if name.is_none() {
-                name = Some(value.to_string());
-            }
-        } else if let Some(value) = line.strip_prefix("Exec=") {
-            if exec_cmd.is_none() {
-                exec_cmd = Some(value.to_string());
-            }
+        if let Some(value) = line.strip_prefix("Name=")
+            && name.is_none()
+        {
+            name = Some(value.to_string());
+        } else if let Some(value) = line.strip_prefix("Exec=")
+            && exec_cmd.is_none()
+        {
+            exec_cmd = Some(value.to_string());
         }
     }