Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dist/user/varde.service

@@ -0,0 +1,15 @@
+# varde per-user service (systemctl --user). Pairs with the user
+# varde.socket; stores under $XDG_DATA_HOME/varde.
+[Unit]
+Description=varde content-addressed blob mirror daemon (user)
+Documentation=man:varde(8)
+Requires=varde.socket
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/varde-daemon --user
+Restart=on-failure
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=default.target

dist/user/varde.socket

@@ -0,0 +1,9 @@
+# Socket activation for the per-user varde daemon.
+[Unit]
+Description=varde API socket (user)
+
+[Socket]
+ListenStream=%t/varde.sock
+
+[Install]
+WantedBy=sockets.target