Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -65,14 +65,12 @@ details):
 
 ```sh
 make deb && sudo apt install ./dist/jarl_*.deb   # or: make && sudo make install, see install.md
-sudo -u jarl jarld init --token            # first admin + a CLI token
+sudo -u jarl jarld init                    # database + first administrator
 sudo -u jarl jarld import                  # read the current named.conf and zones
 sudo jarld adopt                           # switch named over (keeps a backup, rolls back on failure)
 sudo systemctl enable --now jarl
 
-jarl config set server http://127.0.0.1:8053
-jarl config set token                      # paste the token from 'jarld init'
-jarl status
+sudo jarl status                           # root on the server needs no token (local socket)
 ```
 
 Then open the web UI at `http://127.0.0.1:8053/`, or set `listen` and `tls`