Milestone 5: metered awareness, DSCP, systemd, man pages, packaging

Metered detection polls NetworkManager's Metered property over D-Bus
(feature "metered", default on; builds without D-Bus via
no-default-features). While metered the daemon closes incoming blob
connections and defers every fetch; VARDE_FORCE_METERED=true forces the
state as a kill switch and test hook. Endpoint UDP sockets get DSCP CS1
best-effort by matching bound ports to /proc/net/udp inodes (iroh hides
its fds). systemd socket activation adopts LISTEN_FDS fd 3, readiness
is a hand-rolled sd_notify READY=1 (abstract + path sockets), and
standalone binding still works unchanged. dist/ ships hardened system
and user units (DynamicUser, ProtectSystem=strict, StateDirectory,
RestrictAddressFamilies), a commented config example, scdoc man pages
validated with scdoc, and an untested PKGBUILD skeleton.

Tests: activation-socket round trip via a real fd-3 handoff, READY=1
received on a NOTIFY_SOCKET, metered daemons neither serve nor fetch.

Dependencies: zbus (optional, feature-gated D-Bus client for the
NetworkManager metered flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

varde-daemon/Cargo.toml

@@ -22,6 +22,8 @@ n0-future = "0.1"
 async-channel = "2"
 futures-lite = "2"
 bytes = "1"
+# Feature-gated D-Bus client for NetworkManager metered status.
+zbus = { version = "5", optional = true, default-features = false, features = ["tokio"] }
 iroh-io = { workspace = true }
 reflink-copy = { workspace = true }
 anyhow = { workspace = true }
@@ -33,6 +35,12 @@ toml = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 
+[features]
+# Metered-connection detection via NetworkManager over D-Bus. On by
+# default; disable for systems without D-Bus (they run as unmetered).
+default = ["metered"]
+metered = ["dep:zbus"]
+
 [dev-dependencies]
 tempfile = "3"
 proptest = "1"