feat(lockscreen,polkit): face authentication via Gaze

[bennypowers]

Summary

• Add face unlock to the lockscreen using GunduLabs/gaze facial authentication daemon via D-Bus (com.gundulabs.Gaze)
• Add polkit auto-response for GAZE_CONFIRMATION_REQUEST from pam_gaze.so, enabling face auth through the polkit PAM stack
• Add face-auth config toggle and settings UI entry under Security > Lock Screen

Details

FaceAuthenticator mirrors the existing FingerprintAuthenticator pattern:

• Pre-checks HasEnrolledFaces and IsCameraAvailable before claiming
• Async Claim/Release session lifecycle with VerifyStart/VerifyStop
• Subscribes to FaceStatus (capture quality feedback) and VerifyStatus (match result) signals
• Retries up to 3 times on verify-no-match with 500ms delay
• Handles sleep/wake via PrepareForSleep with deferred proxy reclaim for stale claims
• Runs concurrently with fingerprint auth; whichever succeeds first unlocks

When Gaze is not installed or no face is enrolled, face auth silently bails with no errors.

For polkit, when pam_gaze.so is in the polkit PAM stack and sends a GAZE_CONFIRMATION_REQUEST prompt on successful face match, noctalia auto-responds with CONFIRM.

Test plan

• Build and install with Gaze not installed: lockscreen and polkit work normally, no errors in log
• Build with Gaze installed, face enrolled: lockscreen shows "Look at the camera", unlocks on face match
• Verify face auth retries on no-match, stops after 3 failures
• Verify face auth stops when user starts typing password, restarts after failed password attempt
• Verify sleep/wake: face auth restarts after resume
• Verify settings toggle disables face auth
• Verify polkit face auth with pam_gaze.so in /etc/pam.d/polkit-1
• Verify concurrent fingerprint + face auth both work, first to succeed unlocks

Closes #3000

[bennypowers]

Currently, when the lockscreen comes up, a gaze session starts immediately, runs the CPU until timeout, then cancels, and subsequently falls back to password authentication. Not ideal. I'd like to get some feedback on this for a better workflow.