Milestone 3: iroh endpoint, tickets, pin-triggered fetch

The daemon binds an iroh endpoint (ed25519 identity at secret.key,
0600), serves its store via Blobs/Router on the standard ALPN, and
fetches with the iroh-blobs Downloader rather than the rpc client to
keep quic-rpc out of the tree. Relay is disabled unless wan_upload is
set: LAN-only, zero WAN upload by default. TicketImport pins first
(the pin is the GC root protecting in-flight data), registers the
ticket's NodeAddr with the endpoint (the downloader dials by NodeId
alone), then fetches in the background; completion emits pin_complete.

Tests: two-daemon localhost transfers (blob + directory collection,
byte-identical), and kill -9 mid-transfer followed by restart on the
same store resuming to completion.

Dependencies: iroh 0.35 (endpoint/router, pairs with iroh-blobs 0.35),
rand 0.8 (secret key generation, same version iroh uses).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

varde-daemon/src/store.rs

@@ -87,6 +87,11 @@ impl BlobStore {
         &self.store
     }
 
+    /// The local pool the transfer layer shares for non-`Send` blob work.
+    pub fn pool_handle(&self) -> LocalPoolHandle {
+        self.pool.clone()
+    }
+
     /// Import a file or directory. Returns the root hash, total imported
     /// bytes, and the resulting format (`Raw` for files, `HashSeq` for
     /// directories).