ltk: ext-session-lock-v1 client surface mode, plus a read-only mode for text fields

Add a third Wayland surface type to the runtime so an ltk `App` can be a screen locker, alongside the existing xdg-shell window and wlr-layer-shell surfaces. A new `ShellMode::SessionLock` makes `run()` bind `ext_session_lock_manager_v1` and request the lock at startup; the lock surface itself is created in the new `SessionLockHandler::locked` callback (one surface on the first advertised output) and replaces the `SurfaceKind::PendingLock` placeholder the main surface holds until the compositor grants the lock. The `configure` event routes through the same `on_configure` path as layer and xdg surfaces, so sizing and rendering are unchanged, and `finished` (the compositor denied or ended the lock) tears the loop down. The whole thing is additive and opt-in: the `Window` and `Layer` paths are untouched and nothing enters lock mode unless an `App` returns `ShellMode::SessionLock`, so existing apps are unaffected — the only non-additive edits are the two exhaustive `match`es on `SurfaceKind` (`wl_surface` / `try_wl_surface`), which gain arms for the two new variants.
Doing the locker as a first-class surface rather than compositing a static texture into an offscreen `UiSurface` is the whole point: the compositor gives the lock surface keyboard focus, so ltk's existing text-input, editing, focus and IME machinery works inside the lock exactly as on any other surface — cursor, click-to-focus, Tab, character input. A locker built on top of this is just a normal interactive ltk app that happens to be presented on the lock layer, with no special input plumbing on the compositor or the app side.
`App::requested_exit()` is the new way an app asks the runtime to tear the surface down and leave the loop; it is polled after every batch of `update`s. It exists because of the one hard invariant of `ext-session-lock-v1`: a locker that disconnects without sending `unlock` leaves the compositor's outputs blanked forever — that is the protocol's deliberate anti-bypass guarantee. So when `requested_exit()` returns true and the surface is a session lock, the loop calls `session_lock.unlock()` and round-trips the connection before setting `exit_requested`, lifting the lock cleanly; for a `Window` or `Layer` surface there is no lock and it simply exits. The consequence for lock apps is that they must stop calling `process::exit` from the lock path and instead flip a flag they return from `requested_exit()`.
`text_edit` gains a `read_only( bool )` builder. A read-only field still renders its box and value in the normal field style but takes no keyboard focus and accepts no input: `Element::is_focusable` and `Element::is_text_input` now return false for a read-only `TextEdit`, which keeps it out of the Tab cycle, off the keyboard-edit path, and stops the cursor from ever being drawn on it. The flag is carried through `map_msg` so it survives `Element::map`. This is for presenting a known, non-editable value in the same visual idiom as the editable fields beside it — for example the already-known user shown on a session lock, where letting that field take focus or blink a cursor would be wrong.
The `shell_mode()` doc comment and the README now list the `SessionLock` surface type and point at `requested_exit()` for the unlock. Two warnings are cleared along the way: the runtime no longer stores the `SessionLockState` after requesting the lock — it has no `Drop`, so the manager object outlives the dropped handle inside the connection and the lock lifecycle runs entirely off the returned `SessionLock`, which removes a never-read field — and a pre-existing rustdoc `private_intra_doc_links` warning in `list_item` (a public doc comment linking to the private `theme::ICON_SIZE`) is downgraded to plain code formatting.

src/event_loop/run.rs

@@ -143,6 +143,11 @@ pub( crate ) fn try_run<A: App>( app: A ) -> Result<(), RunError>
 		use crate::app::ShellMode;
 		match app.shell_mode()
 		{
+			ShellMode::SessionLock => {
+				// Lock surface is created in SessionLockHandler::locked once the
+				// compositor grants the lock; until then a placeholder.
+				( SurfaceKind::PendingLock, None )
+			}
 			ShellMode::Window => {
 				let xdg     = bind_xdg( &globals, &qh )?;
 				let surface = compositor.create_surface( &qh );
@@ -183,6 +188,20 @@ pub( crate ) fn try_run<A: App>( app: A ) -> Result<(), RunError>
 		}
 	};
 
+	// Bind the session-lock manager and request the lock. We don't keep the
+	// `SessionLockState` (the manager) around: it has no `Drop`, so the
+	// manager object persists in the connection, and the lock lifecycle runs
+	// entirely off the returned `SessionLock` + its surfaces.
+	let session_lock =
+		if force_window.is_none() && matches!( app.shell_mode(), crate::app::ShellMode::SessionLock )
+		{
+			smithay_client_toolkit::session_lock::SessionLockState::new( &globals, &qh )
+				.lock( &qh )
+				.ok()
+		} else {
+			None
+		};
+
 	let text_input_manager: Option<ZwpTextInputManagerV3> = globals.bind( &qh, 1..=1, () ).ok();
 	// wl_data_device_manager: optional. Required for cross-application
 	// copy/paste; absence means the clipboard stays process-local.
@@ -243,6 +262,7 @@ pub( crate ) fn try_run<A: App>( app: A ) -> Result<(), RunError>
 		output_state:       OutputState::new( &globals, &qh ),
 		compositor_state:   compositor,
 		shm,
+		session_lock,
 		egl_context,
 		xdg_shell,
 		layer_shell:        layer_shell_opt,
@@ -459,6 +479,20 @@ pub( crate ) fn try_run<A: App>( app: A ) -> Result<(), RunError>
 			let pf = data.pointer_focus;
 			data.dispatch_cursor_shape( pf );
 		}
+
+		// App asked to exit (e.g. the lockscreen authenticated). For a
+		// session-lock surface, unlock first — exiting without unlocking
+		// leaves the compositor's lock in place by design.
+		if data.app.requested_exit()
+		{
+			if let Some( lock ) = data.session_lock.take()
+			{
+				lock.unlock();
+				let _ = conn.roundtrip();
+			}
+			data.exit_requested = true;
+		}
+
 		// Seed `on_drag_move` with the long-press origin for any drag that
 		// just started. Must run *after* `update()` so the app's drag state
 		// has already been set up by the paired long-press message — the