Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -24,6 +24,14 @@ The first version, to be released as 0.1.0.
   the web UI. Networks smaller than a /24 explain that they belong in the
   enclosing /24's zone.
 - docs/operations.md: setting up a secondary server with its own jarld.
+- A local unix socket, `/run/jarl/jarl.sock` (`socket` in jarl.yaml).
+  Requests on it from root or jarld's own user need no token and act as
+  an administrator (the kernel's `SO_PEERCRED` says who is connecting);
+  anyone else must send a token. The `jarl` CLI uses it when no server is
+  configured, or with `-s local`, so `sudo jarl status` works on the
+  server with nothing set up, and losing every token or password never
+  locks root out. Changes are audited under the system user's name via
+  `socket`. The systemd unit creates `/run/jarl` (0750).
 - Jarl is released under the MIT License (`LICENSE`), which is installed
   with the docs and is the Debian package's `copyright` file (with the
   bundled Cinzel font's OFL).