Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dist/varde-ctl.1.scd

@@ -0,0 +1,84 @@
+varde-ctl(1)
+
+# NAME
+
+varde-ctl - control the varde blob mirror daemon
+
+# SYNOPSIS
+
+*varde-ctl* [*--socket* _PATH_] [*--json*] _COMMAND_ [_ARGS_]
+
+# DESCRIPTION
+
+Command-line client for *varde*(8), speaking the JSON Lines socket
+protocol. Doubles as the protocol's reference implementation: every
+subcommand maps 1:1 onto a request.
+
+# GLOBAL OPTIONS
+
+*--socket* _PATH_
+	Daemon socket (env: *VARDE_SOCKET*). Default:
+	_/run/varde/varde.sock_ as root, _$XDG_RUNTIME_DIR/varde.sock_
+	otherwise.
+
+*--json*
+	Print the raw JSON response envelope instead of human output.
+
+# COMMANDS
+
+*add* [-r|--recursive] _PATH_
+	Import a file (or, with *-r*, a directory tree) into the store.
+	Prints the root hash. Content is not pinned by adding — pin it to
+	protect it from *gc*.
+
+*pin* [--open-lan] _HASH_
+	Standing intent: keep this content, fetch it if absent, serve it to
+	trusted peers. *--open-lan* serves it to any LAN peer.
+
+*unpin* _HASH_
+	Remove the intent. Data stays until *gc*.
+
+*materialize* [--mode reflink-or-copy|copy] _HASH_ _DEST_
+	Export content to a path. The default mode reflinks when the
+	filesystem supports it and falls back to copying.
+
+*status* [_HASH_]
+	Daemon status, or presence/completeness of one hash.
+
+*list*
+	All pins with policy and completeness.
+
+*ticket export* _HASH_
+	Print an iroh ticket for out-of-band sharing. Note: exporting
+	grants standing consent to serve that content to anyone (the
+	ticket holder is not on the allowlist).
+
+*ticket import* [--open-lan] _TICKET_
+	Pin the ticket's content and fetch it from the embedded provider.
+
+*peer trust* _NODE-ID_
+	Add a peer to the allowlist. Content is served to and auto-fetched
+	from trusted peers only. Applies to connections made after the
+	change.
+
+*peer untrust* _NODE-ID_
+	Remove a peer from the allowlist.
+
+*peer list*
+	Trusted peers and whether they are currently present on the LAN.
+
+*gc*
+	Drop all blobs not reachable from a pin. Never runs implicitly.
+
+*subscribe*
+	Stream daemon events (transfer progress, peer presence, pin
+	completion) as JSON lines until interrupted.
+
+# EXIT STATUS
+
+0 on success; nonzero with a structured error (code and message) on
+stderr otherwise.
+
+# SEE ALSO
+
+*varde*(8)