fix: Audit-Findings — Bugs, Security-Hardening und Performance

- BUG-02: cancel_session bei mehrstufiger Auth (z.B. TOTP)
- BUG-03: CalledProcessError bei reboot/shutdown abfangen
- M-1+EH-01: configparser interpolation=None + Error-Handling
- H-1: Exec-Cmd Validierung (absoluter Pfad erforderlich)
- PERF: Theme-Guard, Default-Avatar-Cache, Avatar-Cache per User
- Mutable Default Arguments in sessions.py (list → tuple)
- Ungenutzten Gio-Import entfernt

src/moongreet/sessions.py

@@ -5,8 +5,8 @@ import configparser
 from dataclasses import dataclass
 from pathlib import Path
 
-DEFAULT_WAYLAND_DIRS = [Path("/usr/share/wayland-sessions")]
-DEFAULT_XSESSION_DIRS = [Path("/usr/share/xsessions")]
+DEFAULT_WAYLAND_DIRS = (Path("/usr/share/wayland-sessions"),)
+DEFAULT_XSESSION_DIRS = (Path("/usr/share/xsessions"),)
 
 
 @dataclass
@@ -37,8 +37,8 @@ def _parse_desktop_file(path: Path, session_type: str) -> Session | None:
 
 
 def get_sessions(
-    wayland_dirs: list[Path] = DEFAULT_WAYLAND_DIRS,
-    xsession_dirs: list[Path] = DEFAULT_XSESSION_DIRS,
+    wayland_dirs: tuple[Path, ...] = DEFAULT_WAYLAND_DIRS,
+    xsession_dirs: tuple[Path, ...] = DEFAULT_XSESSION_DIRS,
 ) -> list[Session]:
     """Discover available sessions from .desktop files."""
     sessions: list[Session] = []