shell: dock reorder, fullscreen detection fix, idle-power, sessiond, misc shell work

- Dock drag-to-reorder for pinned apps (insertion gap, quick-slide vs dwell)
- Fullscreen detection: scan all windows via HyprlandData.windowList
- IdleCoordinator, GlobalStates, Session.qml updates
- Deploy script, qmldir, settings, wallpaper, visualizer fixes
- sessiond server, memory module updates

Co-Authored-By: Claude <noreply@anthropic.com>

surfaces/quickshell/services/SessiondBridge.qml

@@ -21,6 +21,10 @@ import qs
 Singleton {
     id: root
 
+    // Only shell.qml calls claimAuthority(). Importing this singleton from a
+    // utility window must never create a session-authority connection.
+    property bool authorityScope: false
+
     // Registered = shell_ready was answered ok on the CURRENT connection.
     property bool registered: false
     // sessiond held the session lock when we registered; we owe it a lock
@@ -29,12 +33,24 @@ Singleton {
     property bool ackSent: false
     property var pendingReady: null // callback awaiting the shell_ready response
 
-    function load() {}
+    function claimAuthority() {
+        root.authorityScope = true
+    }
+
+    function load() {
+        if (!root.authorityScope)
+            console.log("[sessiond-bridge] inactive outside authority scope")
+    }
 
     // Announce the shell. cb(mustLock) fires exactly once: mustLock true
     // means sessiond was holding and the session IS locked — the shell must
     // raise its own lock surface immediately.
     function shellReady(cb) {
+        if (!root.authorityScope) {
+            console.log("[sessiond-bridge] shell_ready refused outside authority scope")
+            cb(false)
+            return
+        }
         if (!sock.connected) {
             cb(false);
             return;
@@ -78,14 +94,14 @@ Singleton {
         id: reconnect
         interval: 5000
         repeat: true
-        running: !sock.connected
+        running: root.authorityScope && !sock.connected
         onTriggered: sock.connected = true
     }
 
     Socket {
         id: sock
         path: Quickshell.env("XDG_RUNTIME_DIR") + "/souveraine/sessiond.sock"
-        connected: true
+        connected: root.authorityScope
 
         // `connectionStateChanged` is the real Signal on Quickshell.Io.Socket;
         // the `onSocketConnected`/`onSocketDisconnected` handler-slots aren't