Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -28,6 +28,14 @@ change something (anything but GET/HEAD) must send it as `X-CSRF-Token`.
 `GET /auth/whoami` returns the user, the token (if any), the effective
 permissions and whether the caller is an administrator.
 
+**The local socket**: on jarld's unix socket (`/run/jarl/jarl.sock`),
+requests from root or jarld's own user need no `Authorization` header and
+act as an administrator; other users must send a token:
+
+```sh
+sudo curl --unix-socket /run/jarl/jarl.sock http://localhost/api/v1/status
+```
+
 **HTTP Basic**, only on the lego `httpreq` routes (below): the username is
 the token's user and the password the API token.