fix(auth): prevent infinite PAM retry loops on lock screen

[ConstantinJean]

Summary

Only submit the user's password once per PAM conversation in pam_authenticator.cpp. If PAM prompts for authentication again within the same conversation session (e.g. retry loops), return PAM_CONV_ERR immediately instead of re-supplying the cached password.

Motivation

When authenticating against systemd-homed encrypted homes, pam_systemd_home implements an internal retry loop (up to 5 attempts) on authentication failure.
Because Noctalia was answering all PAM_PROMPT_ECHO_OFF queries with the cached password, failed attempts caused systemd-homed to run 5 sequential cryptographic verifications , resulting in a ~15-second freeze on the lock screen.
Aborting the conversation on subsequent prompts aligns with the PAM conversation specification and matches the approach used by other Wayland lockers (e.g. swaylock), reducing the lockout delay to a single attempt (~3.0 seconds).

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring
• Build / packaging

Related Issue

Close #4283

Testing

Manual testing on Arch Linux (systemd 261, systemd-homed with btrfs/LUKS):

• Locked session via Noctalia under Niri.
• Entered incorrect password:
  • Before: Looped through 5 systemd-homework attempts for ~15 seconds before failing.
  • After: Aborted after 1 attempt (~3 seconds). Journal logs confirm pam_systemd_home returned Conversation error on attempt 2 and terminated cleanly.
• Entered correct password: Unlocked immediately.

Didn't test on non systemd-homed session.

Manual Coverage

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Tested with different bar positions and density settings
• Tested at different interface scaling values
• Tested with multiple monitors

Checklist

• This PR is ready for review, or it is marked as Draft.
• I read and followed the relevant guidance in CONTRIBUTING.md.
• I ran just format with clang-format v22+ installed, or this PR has no code changes.
• I ran the relevant build or test commands, or explained why they were not run.
• I self-reviewed the changes.
• I checked for new warnings or errors.
• I updated user-facing documentation in docs/user/ when this PR changes documented behavior or configuration, or this PR does not require documentation changes.
• I added or updated assets/translations/en.json, or this PR adds no new user-facing strings.
• I did not edit non-English translation files unless this PR is explicitly for translation tooling, an import/export sync, or a maintainer-requested locale change.
• I used the existing canonical names for config keys, IPC names, paths, and identifiers.

[ItsLemmy]

The description now contains the required template structure.