feat(desktop): gtklock replaces swaylock, GTK theme moves to Mocha

Looking at whether gtklock was worth it turned up two things.

The GTK layer was never on Mocha. colloid-gtk-theme with the catppuccin
tweak produces Frappé with a grey accent — base #292c3c, selection #ccd0da
— and #1e1e2e, #b4befe and #cba6f7 appear nowhere in its gtk.css. Kvantum,
the swaylock ring and Zed were all Mocha, so GTK was the one layer out of
step, unnoticed because the two dark bases sit close together.
catppuccin-gtk carries Colloid as a git submodule and only recolors it, so
the switch is a recolor with identical widget shapes.

The old objection to gtklock is gone: 4.0.0 links libgtk-session-lock.so.0,
so it speaks ext-session-lock-v1 like swaylock and the compositor still
holds the lock if it crashes. Only the ≤2.x layer-shell versions unlocked
on a crash. What it adds over swaylock is the modules — avatar, clock and
power buttons — which swaylock cannot do at all.

The blur stays baked into the wallpaper. gtklock cannot blur either: GTK3
has no filter CSS property at all, and it takes no screenshot of the
session, so there is nothing to blur at lock time.

Two rewrites of moonarch config were needed and both take the command from
one lockCommand binding: stasis names the locker in four places, and the
Quickshell power popout spawns it itself. Routing the popout through
`stasis trigger lock-screen` would have named it once, but the Lock button
would then fail silently whenever stasis is down. The reason to want it
turned out not to exist — the plan continues after a manual lock anyway,
because stasis takes the state from logind's LockedHint rather than from
having started the locker. Verified by locking by hand and watching DPMS
fire on schedule.

gtkSettings rewrites the Colloid name out of moonarch's settings.ini files.
Without it every GTK3 application would have fallen back to Adwaita: GTK3
reads those files directly and the dconf entry does not reach it on
Wayland.

Verified after rebuild: both hosts build, /etc/pam.d/gtklock carries the
same `auth sufficient pam_unix.so` swaylock had, the seeded stasis.rune
names gtklock at all four call sites, and the popout spawns it.

modules/services.nix

@@ -269,11 +269,11 @@ in
       niri
       pulseaudio
       libnotify
-      swaylock
+      gtklock
       brightnessctl
       systemd
     ];
-    # No waylandClientHardening: swaylock is a child of this unit and
+    # No waylandClientHardening: the locker is a child of this unit and
     # authenticates through the setuid-root unix_chkpwd. `systemd --user` builds
     # mount namespaces through an unprivileged user namespace, whose mounts are
     # nosuid — the wrapper loses setuid and the session is no longer unlockable.