Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/install.md

@@ -227,10 +227,15 @@ Open `https://<management-address>:8053/` and log in as `admin`.
 
 ## 9. Set up the CLI
 
-The CLI can run on the server or on any machine that can reach jarld.
+On the server itself, root needs nothing: `sudo jarl status` and every
+other command use jarld's local socket without a token
+([cli.md](cli.md#on-the-server-itself)).
+
+On other machines, or as an ordinary user, give the CLI a server and a
+token:
 
 ```sh
-jarl config set server https://ns1.adbraun.lol:8053   # or http://127.0.0.1:8053 on the server
+jarl config set server https://ns1.adbraun.lol:8053
 jarl config set token          # paste the token from 'jarld init' at the prompt
 jarl status
 jarl zone list