feat(auth): brahman-auth — autenticación del escritorio (PAM + mock)

Base del DM/greeter de carmen. Contrato Authenticator agnóstico:
authenticate(usuario, secreto) -> UserInfo (uid/gid/home/shell).
PamAuthenticator verifica contra PAM (/etc/pam.d/carmen); MockAuthenticator
con credenciales en memoria para tests. AuthError grueso: BadCredentials
vs AccountUnavailable, sin filtrar existencia de cuentas. resolve_user
vía getpwnam. data/carmen como servicio PAM; ejemplo auth-probe.

11 tests; el camino PAM real se ejercita.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Cargo.toml

@@ -15,6 +15,7 @@ members = [
     "crates/protocol/brahman-dht",
     "crates/protocol/brahman-card-discovery",
     "crates/protocol/brahman-ssh-multiplex",
+    "crates/protocol/brahman-auth",
     "crates/protocol/arje-card",
 
     # ============================================================
@@ -374,6 +375,9 @@ notify = "6.1"
 clap = { version = "4", features = ["derive"] }
 rpassword = "7"
 
+# === PAM (brahman-auth) ===
+pam = "0.8"
+
 # === D-Bus (arje compat) ===
 zbus = { version = "4", default-features = false, features = ["tokio"] }