Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dist/varde.8.scd

@@ -0,0 +1,77 @@
+varde(8)
+
+# NAME
+
+varde-daemon - content-addressed blob mirror daemon on iroh
+
+# SYNOPSIS
+
+*varde-daemon* [_OPTIONS_]
+
+# DESCRIPTION
+
+varde owns a content-addressed blob store and mirrors content between
+consenting peers. Applications talk to it over a unix socket speaking
+JSON Lines (one request per line, one response per line); *varde-ctl*(1)
+is the reference client.
+
+Discovery is open; replication is explicit. The daemon advertises itself
+via mDNS on the local network (identifiable, never camouflaged), but
+content is only served to peers on the trust allowlist, plus content
+deliberately published per-pin (*open-lan*) or via ticket export. All
+fetched data is BLAKE3-verified regardless of source.
+
+Default traffic posture: LAN only (no relay), upload capped at 10 MiB/s,
+UDP sockets marked DSCP CS1 (best effort), and all transfers stop while
+NetworkManager reports the connection as metered.
+
+# OPTIONS
+
+*--config* _PATH_
+	Config file. Default: _/etc/varde/config.toml_ in system mode,
+	_$XDG_CONFIG_HOME/varde/config.toml_ in user mode. The default file
+	may be absent; an explicitly named one must exist.
+
+*--store* _PATH_
+	Store directory override.
+
+*--socket* _PATH_
+	API socket path override.
+
+*--system*, *--user*
+	Force system-mode or user-mode default paths. Default: system when
+	running as root, user otherwise.
+
+*--version*, *--help*
+	Print version or usage and exit.
+
+# CONFIGURATION
+
+See the commented example at _/etc/varde/config.toml_. Precedence:
+flags > *VARDE_\** environment variables (*VARDE_CONFIG*, *VARDE_STORE*,
+*VARDE_SOCKET*, *VARDE_MAX_UPLOAD*, *VARDE_MAX_DOWNLOAD*,
+*VARDE_DISCOVERY*, *VARDE_WAN_UPLOAD*) > config file > defaults.
+
+# FILES
+
+_/var/lib/varde_ (system), _$XDG_DATA_HOME/varde_ (user)
+	Store directory: iroh-blobs store under _blobs/_, pins and trust in
+	_meta.json_, endpoint key in _secret.key_ (mode 0600).
+
+_/run/varde/varde.sock_ (system), _$XDG_RUNTIME_DIR/varde.sock_ (user)
+	API socket. systemd socket activation (LISTEN_FDS) is supported;
+	without it the daemon binds the socket itself.
+
+# NOTES
+
+Materialization attempts a reflink (FICLONE) before falling back to a
+byte copy; store directory and materialization targets must share a
+filesystem (btrfs/XFS) for reflinks to work. Store files are immutable
+and never hardlinked out.
+
+DSCP marking may require CAP_NET_ADMIN on some systems and is silently
+skipped where unavailable.
+
+# SEE ALSO
+
+*varde-ctl*(1)