The safety layer: two presses for anything you cannot take back

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/dot/quickshell/modules/settings/UsersPage.qml

@@ -276,16 +276,34 @@ SettingsPage {
                         }
                     }
 
-                    SettingsButton {
+                    ConfirmAction {
+                        id: removePicture
+
                         visible: UserAccounts.avatarUrl !== ""
-                        text: "Remove"
+                        actionId: "remove-avatar"
+                        armText: "Remove…"
+                        confirmText: "Remove it"
                         enabled: !UserAccounts.busy
-                        onClicked: {
+                        onConfirmed: {
                             root.pictureOpen = false;
                             UserAccounts.removeIcon();
                         }
                     }
                 }
+
+                // The consequence, said before the confirming press: this
+                // deletes the file accountsservice keeps, so the picture is
+                // gone from the lock screen and every other account surface,
+                // not merely from this page.
+                Text {
+                    width: parent.width
+                    visible: removePicture.armed
+                    text: "The picture is deleted from your account — the lock screen and everywhere else showing it fall back to your initial."
+                    color: Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                    wrapMode: Text.WordWrap
+                }
             }
         }