libsodium has all the components you need, and (on modern hardware) is fast for the AES-GCM part: random number generation for secure nonce, password hashing for key derivation from password, authenticated encryption.
You still need to put those parts together securely, add signing if necessary, decide what to authenticate (perhaps the file name) - to build a secure system.
If you are looking for a library that does almost all of that in a library available in multiple languages, consider the AWS Encryption SDK which is available in C. It's well-designed and heavily-tested, and handles key derivation and commitment, signing (optionally), nonce creation, etc.
You'd still be left with deriving the initial 256 bit raw AES key from your password (plus a salt that you would need to store somewhere), for which you could use libsodium. Use that derived key in the Raw AES Keyring.
One nice feature is the ability to encrypt a plaintext under multiple keys, which means you can encrypt using the normal key plus an emergency RSA public key. In the event the original password-derived key is lost, you can still decrypt the ciphertexts using the RSA private key (that you kept safe somewhere).