Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/milestone-5.md

@@ -0,0 +1,42 @@
+# Milestone 5 — Citizenship
+
+## What landed
+
+- **Metered awareness** (`metered` feature, default on): NetworkManager's
+  `Metered` property is polled over D-Bus every 30 s; while metered (or
+  guessed metered) the daemon serves nothing (connections closed at
+  accept) and defers every fetch. Pins stay recorded; mdns
+  re-announcements retrigger auto-sync once unmetered. Builds without
+  D-Bus via `--no-default-features` (always unmetered then).
+  `VARDE_FORCE_METERED=true` forces the state — a manual kill switch and
+  the test hook.
+- **DSCP CS1** on the endpoint's UDP sockets, best effort. iroh does not
+  expose its socket fds, so we match the endpoint's bound ports against
+  `/proc/net/udp{,6}` inodes and walk `/proc/self/fd` — Linux-only like
+  the daemon itself. Failures are logged at debug and ignored, as the
+  spec allows.
+- **systemd socket activation**: `LISTEN_FDS` (fd 3) is adopted when
+  present, otherwise the daemon binds its own socket — non-systemd
+  distros work identically. Readiness is signaled with a hand-rolled
+  `sd_notify(READY=1)` (abstract and path sockets), no libsystemd
+  dependency. Activation sockets are not unlinked at shutdown; systemd
+  owns them.
+- **dist/**: hardened system units (`DynamicUser`, `ProtectSystem=strict`,
+  `StateDirectory`/`RuntimeDirectory`, `NoNewPrivileges`, restricted
+  address families and syscalls), user units, commented example
+  `config.toml`, scdoc man pages (`varde.8`, `varde-ctl.1`, validated
+  with scdoc), and an explicitly untested `PKGBUILD` skeleton for Arch.
+
+## Decisions
+
+- **Type=notify + Requires=varde.socket** so systemd tracks readiness
+  precisely and activation works out of the box; the same binary still
+  runs under `ExecStart` alone.
+- **Metered gating sits at the two choke points** (connection accept,
+  fetch queue) rather than inside the rate limiter, so the posture is
+  binary and auditable: metered ⇒ zero bytes moved, period.
+- **Polling NM instead of subscribing to PropertiesChanged**: 30 s of
+  staleness is acceptable for a background mirror and the code stays
+  ~40 lines with graceful degradation when NM or D-Bus is absent.
+- `varde-ctl` already had `--json` and human output from milestone 1;
+  the polish here was man-page coverage of every command.