Milestone 4: LAN discovery, trust gate, auto-sync, rate limits, events

mDNS-style LAN discovery (iroh MdnsDiscovery, discovery flag, default
on) feeds a presence tracker; trusted peers that appear trigger fetches
of every incomplete pin, and Pin itself now fetches from present
trusted peers. Serving is our own ProtocolHandler: trusted NodeIds get
the full store, everyone else a filtered view limited to open_lan pins
and ticket-exported hashes (plus hashseq children) that answers "not
found" for the rest. Ticket export records standing serve-consent for
that hash; trust changes take effect on new connections. ShapedStore
implements the full iroh-blobs Store trait to charge provider reads to
an upload token bucket and downloader writes to a download bucket;
upload cap 0 closes incoming connections at accept. Subscribe now
streams transfer_progress both ways, peer_joined, and pin_complete.

Tests: forged-ticket trust gating (denied untrusted, served after
trust), 256 KiB/s upload cap enforced by wall clock, event stream
during a transfer, and real-mdns auto-sync between two daemons
(skips where multicast is unavailable).

Dependencies: n0-future, async-channel, futures-lite, bytes — all
already in the tree via iroh; needed directly to name types in
iroh-blobs trait signatures and channels. iroh feature
discovery-local-network for MdnsDiscovery.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

varde-daemon/src/lib.rs

@@ -7,11 +7,10 @@ pub mod config;
 pub mod daemon;
 pub mod meta;
 pub mod server;
+pub mod shaped;
 pub mod store;
 pub mod transfer;
 
-use std::sync::Arc;
-
 use anyhow::Result;
 
 /// Run a daemon with the given config until the future is dropped or the
@@ -19,7 +18,7 @@ use anyhow::Result;
 /// once this future has been polled the socket path exists.
 pub async fn run(config: config::Config) -> Result<()> {
     let socket_path = config.socket_path.clone();
-    let daemon = Arc::new(daemon::Daemon::open(config).await?);
+    let daemon = daemon::Daemon::open(config).await?;
     let listener = server::bind_socket(&socket_path)?;
     server::serve(listener, daemon).await
 }