Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dist/config.toml

@@ -0,0 +1,28 @@
+# varde example configuration — /etc/varde/config.toml (system) or
+# $XDG_CONFIG_HOME/varde/config.toml (user).
+#
+# Every key is optional; the daemon runs with an empty (or absent)
+# config. Values shown are the defaults. Precedence:
+# CLI flags > VARDE_* environment > this file > defaults.
+
+# Directory holding the blob store, metadata and endpoint secret key.
+# Default: /var/lib/varde (system) or $XDG_DATA_HOME/varde (user).
+#store_dir = "/var/lib/varde"
+
+# Unix socket serving the JSON-lines API.
+# Default: /run/varde/varde.sock (system) or $XDG_RUNTIME_DIR/varde.sock.
+#socket_path = "/run/varde/varde.sock"
+
+# Upload cap in bytes/sec. 0 disables serving entirely.
+#max_upload_bytes_per_sec = 10485760   # 10 MiB/s
+
+# Download cap in bytes/sec. 0 means unlimited.
+#max_download_bytes_per_sec = 0
+
+# LAN peer discovery (mDNS). Discovery is the open tier: being visible
+# costs nothing; serving is still gated on trust and per-pin policy.
+#discovery = true
+
+# Permit WAN traffic (enables the iroh relay for NAT traversal). Off by
+# default: LAN-only posture, zero WAN upload.
+#wan_upload = false