fix: resolve wifi crashes, shell injections, race conditions, and add debug mode

- Remove transient NEED_AUTH/DISCONNECTED error paths from wifi connect
- Guard double-callback in connect_wifi_bssid/connect_wifi_with_password
- Shell-quote user paths in wallpaper, screenshot, screenrecorder services
- Fix OSD hide-timer use-after-free and applet_window stale source ID
- Fix brightness poll timer leak on read failure
- Fix spotlight search stale idle source removal
- Lock dbusmenu _cache mutation under _registry_lock
- Fix entry.revision written outside _registry_lock scope
- Add fabric-cli exec wrapper for lock screen (lock_screen.lock())
- Replace hyprlock with lock screen in power menu and dropdown
- Add debug mode toggle in settings (controls log verbosity)
- Add diagnostic logging to globalmenu click chain

src/services/screenshot.py

@@ -6,6 +6,7 @@ into a concrete request, hands it to a :class:`CaptureBackend`, then raises
 notifications and signals based on the result.
 """
 
+import shlex
 from datetime import datetime
 from pathlib import Path
 
@@ -157,11 +158,13 @@ class Screenshot(Service):
     def _handle_action(self, action: str, path: str) -> None:
         match action:
             case "files":
-                exec_shell_command_async(f"xdg-open {self.screenshots_dir}")
+                exec_shell_command_async(
+                    f"xdg-open {shlex.quote(str(self.screenshots_dir))}"
+                )
             case "view":
-                exec_shell_command_async(f"xdg-open {path}")
+                exec_shell_command_async(f"xdg-open {shlex.quote(path)}")
             case "edit":
-                exec_shell_command_async(f"satty -f {path}")
+                exec_shell_command_async(f"satty -f {shlex.quote(path)}")
 
     def _notify_cancelled(self) -> None:
         self._notifier.notify(