Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/jarl.service

@@ -28,6 +28,9 @@ StateDirectory=jarl
 StateDirectoryMode=0750
 ConfigurationDirectory=jarl
 ConfigurationDirectoryMode=0750
+# /run/jarl: the local API socket (jarl.sock), for root and the jarl user.
+RuntimeDirectory=jarl
+RuntimeDirectoryMode=0750
 
 # Sandboxing. jarld may only write its own state and the directories it
 # manages for named (created by tmpfiles.d/jarl.conf).