locker: restart PAM conversation on user activity after authenticator windows expire

[sjawhar]

Problem

The lock screen starts its PAM conversation the moment the session locks. Authenticator methods with short hardware windows — pam_u2f FIDO2 touch (~15s), fprintd fingerprint (~30s) — time out long before the user returns to the machine, leaving only the parked password prompt. The user's only recourse is submitting an empty/bad password to force the conversation restart that the existing error-path loop already performs.

Fixes #99 (reported there for fingerprint; identical mechanism for FIDO2/U2F keys).

Change

Restart the PAM conversation when the user interacts (key press or surface focus) while locked, if:

• the current conversation has been running for >45s (i.e. the hardware authenticator windows from lock time have expired), and
• no submission is in flight (authenticating), and
• the password field is empty (never discards typed input).

The abort/respawn machinery already existed for the lock/unlock lifecycle (State::Locked drop aborts the task; the pam loop respawns on error) — this wires user activity to it. The extracted start_auth_task method is shared by initial lock and restart.

Testing

On Pop!_OS 24.04 (COSMIC) with pam_u2f (sufficient, before common-auth) + fingerprint + password:

• Lock → immediate unlock via FIDO2 touch: unchanged.
• Lock → wait >45s → press a key: FIDO2 key begins blinking within a beat; touch unlocks. Previously required submitting a bad password first. auth.log confirms the passwordless path (gkr-pam: no password is available for user).
• Lock → wait → type password immediately: works; restart triggers on the first keystroke only when the field is empty, and the fresh conversation reaches the password prompt with subsequent keystrokes buffered into the field as before.
• sudo/greeter login paths unaffected (change is locker-only).

[mmstick]

The PR template is not optional. LLM-generated code without proper disclosure and without signing the developer certificate of origin is not allowed.