Harden deployment, authentication, firewall and media storage failure paths

settings/quickshell/SessionLock.qml

@@ -0,0 +1,61 @@
+import Quickshell
+import Quickshell.Io
+import Quickshell.Wayland
+import Quickshell.Services.Pam
+import QtQuick
+
+Scope {
+    id: root
+    property string password: ""
+    property string errorMessage: ""
+
+    // Immutable configuration, independent of bar edits and reloads.
+    Component.onCompleted: Quickshell.watchFiles = false
+    function requestLock() {
+        Theme.wallFile.reload();
+        sessionLock.locked = true;
+    }
+    IpcHandler {
+        target: "lock"
+        function lock(): void { root.requestLock(); }
+        function secure(): bool { return sessionLock.secure; }
+    }
+    PamContext {
+        id: pam
+        config: "fred-lock"
+        onPamMessage: {
+            if (responseRequired) {
+                respond(root.password);
+                root.password = "";
+            }
+        }
+        onCompleted: result => {
+            root.password = "";
+            if (result === PamResult.Success) sessionLock.locked = false;
+            else root.errorMessage = "Authentication failed";
+        }
+    }
+    WlSessionLock {
+        id: sessionLock
+        // Start only on demand, but always relock after a process crash.
+        locked: true
+        WlSessionLockSurface {
+            color: "black"
+            AuthView {
+                anchors.fill: parent
+                theme: Theme
+                busy: pam.active
+                errorMessage: root.errorMessage
+                onSubmitted: password => {
+                    if (pam.active || password === "") return;
+                    root.errorMessage = "";
+                    root.password = password;
+                    if (!pam.start()) {
+                        root.password = "";
+                        root.errorMessage = "Authentication unavailable";
+                    }
+                }
+            }
+        }
+    }
+}