Lead Appearance with light and dark, and stop pages listing whole datasets

Appearance was six cards deep and Light/Dark was the third of them, below the
wallpaper grid and the entire lock screen -- so the control reached most often
was the last one you got to. It is five tabs now, Theme first. The mock showed
four; the page turned out to have eleven cards, so Titlebars and Windows became
Windows, and Clock and vitals became Shell, rather than pretending four would
hold them.

Region, Date & Time and Displays each rendered a complete dataset as rows: every
installed locale, the whole tz database, every mode the monitor advertises. The
chooser was never the problem -- SearchPicker already existed and worked. It was
simply rendered always-expanded, so the one line saying what is currently set sat
under hundreds that were not. PickerRow collapses each behind its current value
and closes again once something is picked.

The avatar never appeared to change because accountsservice writes every picture
to the same path, leaving the URL byte-identical while Qt served its cached
image. cache:false was already set and could not have helped: an unchanged source
is never re-read at all. avatarUrl now carries a revision fragment, bumped only
when a write actually succeeds. Pictures are cropped before they are set, in the
picture's own pixel coordinates so the result does not depend on the size it
happened to be displayed at, and written out at 512x512 through GdkPixbuf --
already a dependency here, so nothing new is required.

Snapshots listed nothing. The timeline and its Delete buttons existed the whole
time, behind a row labelled "Browse...", a word that promises a file browser. The
three most recent points are shown inline now, with the rest one press away.

qmldir-registration-contract exists because an unregistered component is not a
quiet problem: Quickshell fails the entire configuration on it, so the settings
window dies and the bar and dock go with it. That happened twice while writing
this, both times on a machine somebody was using. It is pure file inspection, so
it runs before a change ever reaches the running shell.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/scripts/panama-users

@@ -15,7 +15,7 @@ passed that way is published to every process on the machine.
 
     panama-accounts snapshot
     panama-accounts set-real-name USER NAME
-    panama-accounts set-icon USER PATH
+    panama-accounts set-icon USER PATH [X Y SIZE]
     panama-accounts set-account-type USER standard|administrator
     panama-accounts set-automatic-login USER true|false
     panama-accounts set-password USER          (new password on stdin)
@@ -29,6 +29,7 @@ import json
 import os
 import re
 import subprocess
+import tempfile
 import sys
 
 ACCOUNTS = "org.freedesktop.Accounts"
@@ -145,13 +146,74 @@ def set_real_name(username: str, name: str) -> None:
          GLib.Variant("(s)", (name,)))
 
 
-def set_icon(username: str, path: str) -> None:
+# What an avatar is written out at. accountsservice stores whatever it is
+# handed, so a 4000px photograph would sit on disk forever to be drawn at 48.
+AVATAR_SIZE = 512
+
+
+def crop_square(path: str, x: int, y: int, size: int) -> str:
+    """Cut a square out of a picture and write it at avatar size.
+
+    Returns a path to a new file; the caller is responsible for removing it.
+    GdkPixbuf rather than a new dependency -- gi is already required here for
+    accountsservice itself.
+    """
+    import gi
+    gi.require_version("GdkPixbuf", "2.0")
+    from gi.repository import GdkPixbuf
+
+    try:
+        picture = GdkPixbuf.Pixbuf.new_from_file(path)
+    except Exception as error:
+        raise BoundaryError("That file is not a picture this can read.") from error
+
+    if size <= 0:
+        raise BoundaryError("That is not a region of the picture.")
+
+    # Clamped rather than rejected: a drag that ends a pixel outside the image
+    # is a normal thing to do with a pointer, not an error worth refusing.
+    x = max(0, min(x, picture.get_width() - 1))
+    y = max(0, min(y, picture.get_height() - 1))
+    size = min(size, picture.get_width() - x, picture.get_height() - y)
+    if size <= 0:
+        raise BoundaryError("That region is outside the picture.")
+
+    square = picture.new_subpixbuf(x, y, size, size)
+    scaled = square.scale_simple(AVATAR_SIZE, AVATAR_SIZE, GdkPixbuf.InterpType.BILINEAR)
+    if scaled is None:
+        raise BoundaryError("That picture could not be resized.")
+
+    handle, out = tempfile.mkstemp(prefix="panama-avatar-", suffix=".png")
+    os.close(handle)
+    # accountsservice reads this as root and copies it; it must not be private
+    # to this user, and it is deleted as soon as that copy has happened.
+    os.chmod(out, 0o644)
+    scaled.savev(out, "png", [], [])
+    return out
+
+
+def set_icon(username: str, path: str, region: tuple[int, int, int] | None = None) -> None:
     from gi.repository import GLib
 
     if not os.path.isfile(path):
         raise BoundaryError("That picture no longer exists.")
-    call(user_path(username), USER_INTERFACE, "SetIconFile",
-         GLib.Variant("(s)", (path,)))
+
+    source = path
+    temporary = None
+    if region is not None:
+        temporary = source = crop_square(path, *region)
+
+    try:
+        call(user_path(username), USER_INTERFACE, "SetIconFile",
+             GLib.Variant("(s)", (source,)))
+    finally:
+        # SetIconFile copies the file before it returns, so this is safe here
+        # and leaving it behind would litter /tmp with every picture ever set.
+        if temporary is not None:
+            try:
+                os.unlink(temporary)
+            except OSError:
+                pass
 
 
 def set_account_type(username: str, kind: str) -> None:
@@ -236,6 +298,12 @@ def main(arguments: list[str]) -> int:
             set_real_name(arguments[1], arguments[2])
         elif len(arguments) == 3 and arguments[0] == "set-icon":
             set_icon(arguments[1], arguments[2])
+        elif len(arguments) == 6 and arguments[0] == "set-icon":
+            try:
+                region = tuple(int(value) for value in arguments[3:6])
+            except ValueError:
+                raise BoundaryError("That is not a region of the picture.")
+            set_icon(arguments[1], arguments[2], region)
         elif len(arguments) == 3 and arguments[0] == "set-account-type":
             set_account_type(arguments[1], arguments[2])
         elif len(arguments) == 3 and arguments[0] == "set-automatic-login":
@@ -249,7 +317,7 @@ def main(arguments: list[str]) -> int:
         else:
             raise BoundaryError(
                 "Usage: panama-accounts snapshot | set-real-name USER NAME | "
-                "set-icon USER PATH | set-account-type USER standard|administrator | "
+                "set-icon USER PATH [X Y SIZE] | set-account-type USER standard|administrator | "
                 "set-automatic-login USER true|false | set-password USER | "
                 "create-user USERNAME REALNAME standard|administrator | "
                 "delete-user USERNAME keep-files|remove-files")