Add a local unix socket for root on the server

jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests
on it from root or jarld's own user need no token and act as an
administrator; the kernel's SO_PEERCRED says who is connecting, and
anyone else must send a token. The jarl CLI uses the socket when no server
is configured, or with -s local, so 'sudo jarl status' works on the server
with nothing set up and a lost token or password never locks root out.
Changes are audited under the system user's name via "socket".

The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes
are refused with a clear message. The docs explain the socket and what
happens when a token is revoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -86,8 +86,11 @@ $NAMED -c $E/legacy/named.conf -f -n 1 > $E/named.log 2>&1 &
 NAMED_PID=$!
 for i in $(seq 50); do $RNDC -k $E/legacy/rndc.key -s 127.0.0.1 -p $CTL status >/dev/null 2>&1 && break; sleep 0.2; done
 
+# The local socket (a short path: unix socket paths are limited to 107 bytes).
+SOCK=${XDG_RUNTIME_DIR:-/tmp}/jarl-e2e-$HTTP.sock
 cat > $E/jarl.yaml <<EOF
 listen: ["127.0.0.1:$HTTP"]
+socket: $SOCK
 database: $E/data/jarl.db
 staging_dir: $E/data/staging
 log: {level: info}
@@ -133,6 +136,12 @@ expect_dig() { # DESC WANT DIG-ARGS...
 }
 contains() { if echo "$OUT" | grep -q -- "$1"; then ok "output has '$1'"; else bad "output lacks '$1'"; echo "$OUT" | sed 's/^/    /'; fi; }
 
+# With nothing configured, the CLI uses jarld's local socket, where
+# jarld's own user (this script's) is an administrator without a token.
+run "socket: nothing configured uses local jarld" 0 env JARL_SOCKET=$SOCK $J whoami
+contains "admin (everything)"
+run "socket: missing socket is explained" 1 env JARL_SOCKET=${XDG_RUNTIME_DIR:-/tmp}/jarl-e2e-none.sock $J status
+contains "no local jarld"
 run "config set server" 0 $J config set server http://127.0.0.1:$HTTP
 run "config set token (from stdin)" 0 sh -c "$J config set token < $E/admin.token"
 run "config show masks token" 0 $J config show
@@ -143,6 +152,8 @@ run "whoami" 0 $J whoami
 contains "admin (everything)"
 run "zone list" 0 $J zone list
 contains "adbraun.test"
+run "socket: -s local with a server configured" 0 env JARL_SOCKET=$SOCK $J -s local zone list
+contains "adbraun.test"
 
 # Records
 run "record add with PTR" 0 $J record add adbraun.test web A 192.168.1.30 --ptr --ttl 300