Maybe you missed that in my OP I said I could even shutdown by launching konsole and typing “sudo shutdown 0” instead of pressing the “power off” button from KDE. I didn’t need to turn off GUI.
I guess the difference is between the two commands “sudo shutdown 0” and the equivalent command of the KDE shutdown button
qdbus org.kde.ksmserver /KSMServer logout 0 1 2
More tests show that if I log out first using the KDE leave button, then “shutdown button” works in the login screen.
I used the machine for a few days, and found most things would work normally with the restrictive files permission config, including playing games etc. Things like changing the wifi status would require a root pw prompt but that’s not a big deal atm.
I will try and see if I could find the solution some other day. For now, I will just launch the terminal and type the shutdown command manually.