Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -46,6 +46,30 @@ file is `~/.config/jarl/config.yaml` (mode 0600), or `--config` /
 Get tokens from the web UI (Account → API tokens), from
 `jarl token create`, or from `jarld init --token` on the server.
 
+### On the server itself
+
+On the DNS server, root needs no setup at all:
+
+```sh
+sudo jarl status
+sudo jarl record add adbraun.lol www A 192.0.2.10
+```
+
+With no server configured, the CLI talks to jarld through its local unix
+socket, `/run/jarl/jarl.sock`, where root and the `jarl` user are
+administrators without a token ([permissions.md](permissions.md#the-local-socket)).
+The history and audit log show such changes as made by `root` via
+`socket`.
+
+* `-s local` (or `JARL_SERVER=local`) uses the socket even when servers
+  are configured, and `local` can be part of a list (`-s local,ns2`).
+  `local` is reserved and can't be a configured server's name.
+* `JARL_SOCKET` points at another socket path.
+* A token given with `--token` or `JARL_TOKEN` is sent over the socket as
+  well, and then its permissions apply.
+* Other users get a clear error ("only root and the jarl user can use
+  jarld's local socket"); they configure a server and token as above.
+
 ### Several servers and groups
 
 With more than one Jarl (say a primary and a secondary, each with its own