feat(sway): browser-aware idle inhibits + post-resume lock grace

Two related session-idle improvements:

1. ScreenSaver inhibit bridge. Browsers (LibreWolf/Chromium flatpaks)
   ask the session not to idle via the legacy
   org.freedesktop.ScreenSaver D-Bus API during video calls and
   fullscreen video; swayidle only honors logind's BlockInhibited
   property. Add inhibridge as a user unit to translate the former
   into the latter, so e.g. a Google Meet tab now keeps the screen
   from locking, dimming and (downstream) suspending.

2. Post-resume grace period. Locking on before-sleep meant every wake
   demanded the password even for a quick check. Replace with:
     before-sleep -> only pause media
     after-resume -> resume-lock-grace.sh 30
   The grace script runs a one-shot swayidle that locks iff the user
   stays idle for 30s after the wake, with a watchdog that exits as
   soon as swaylock comes up (or after a hard cap) so it never lingers
   alongside the main swayidle. The 5-min main idle-lock and explicit
   loginctl lock-session paths are unchanged.

1 files changed, 35 insertions, 0 deletions

diff --git a/dot_config/sway/executable_resume-lock-grace.sh b/dot_config/sway/executable_resume-lock-grace.sh
new file mode 100644
index 0000000..212eaa1
--- /dev/null
+++ b/dot_config/sway/executable_resume-lock-grace.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+# resume-lock-grace: lock the screen if the user stays idle for $1
+# (default 30) seconds after waking from suspend. Designed to be invoked
+# from swayidle's `after-resume` so a quick wake-and-keep-using doesn't
+# require typing the password, while a wake-and-walk-away still locks.
+#
+# Implementation: spawn a one-shot swayidle that locks once and exits.
+# A watchdog kills it as soon as swaylock is detected, and a hard cap
+# guarantees we never linger competing with the main swayidle.
+set -eu
+
+GRACE="${1:-30}"
+LOCK_CMD='swaylock -f -e -c 282828'
+HARD_CAP=$((GRACE * 4))
+
+# If a lock is already up (e.g. main swayidle already fired), do nothing.
+pgrep -x swaylock >/dev/null && exit 0
+
+swayidle -w timeout "$GRACE" "$LOCK_CMD" >/dev/null 2>&1 &
+PID=$!
+
+elapsed=0
+while [ "$elapsed" -lt "$HARD_CAP" ]; do
+    if pgrep -x swaylock >/dev/null; then
+        break
+    fi
+    if ! kill -0 "$PID" 2>/dev/null; then
+        exit 0
+    fi
+    sleep 1
+    elapsed=$((elapsed + 1))
+done
+
+kill "$PID" 2>/dev/null || true
+wait 2>/dev/null || true