fix: audit fixes — blur offset, lock-before-IO, FP signal lifecycle, TOCTOU (v0.6.6)

Third triple audit (quality, performance, security). Key fixes:
- Blur padding offset: texture at (-pad,-pad) prevents edge darkening on all sides
- Wallpaper loads after lock.lock() — disk I/O no longer delays lock acquisition
- begin_verification disconnects old signal handler before registering new one
- resume_async resets failed_attempts to prevent premature exhaustion
- Unknown VerifyStatus with done=true triggers restart instead of hanging
- symlink_metadata() replaces separate is_file()+is_symlink() (TOCTOU)
- faillock_warning dead code removed, blur sigma clamped to [0,100]
- Redundant Zeroizing<Vec<u8>> removed, on_verify_status restricted to pub(crate)
- Warn logging for non-UTF-8 GECOS and avatar path errors
- Default impl for FingerprintListener, 3 new tests (47 total)

src/users.rs

@@ -18,7 +18,13 @@ pub struct User {
 pub fn get_current_user() -> Option<User> {
     let uid = getuid();
     let nix_user = NixUser::from_uid(uid).ok()??;
-    let gecos = nix_user.gecos.to_str().unwrap_or("").to_string();
+    let gecos = match nix_user.gecos.to_str() {
+        Ok(s) => s.to_string(),
+        Err(_) => {
+            log::warn!("GECOS field is not valid UTF-8, falling back to username");
+            String::new()
+        }
+    };
     let display_name = if !gecos.is_empty() {
         let first = gecos.split(',').next().unwrap_or("");
         if first.is_empty() { nix_user.name.clone() } else { first.to_string() }
@@ -31,13 +37,17 @@ pub fn get_avatar_path(home: &Path, username: &str) -> Option<PathBuf> {
 }
 
 pub fn get_avatar_path_with(home: &Path, username: &str, accountsservice_dir: &Path) -> Option<PathBuf> {
-    // ~/.face takes priority
+    // ~/.face takes priority — single stat via symlink_metadata to avoid TOCTOU
     let face = home.join(".face");
-    if face.exists() && !face.is_symlink() { return Some(face); }
+    if let Ok(meta) = face.symlink_metadata() {
+        if meta.is_file() && !meta.file_type().is_symlink() { return Some(face); }
+    }
     // AccountsService icon
     if accountsservice_dir.exists() {
         let icon = accountsservice_dir.join(username);
-        if icon.exists() && !icon.is_symlink() { return Some(icon); }
+        if let Ok(meta) = icon.symlink_metadata() {
+            if meta.is_file() && !meta.file_type().is_symlink() { return Some(icon); }
+        }
     }
     None
 }