Let jarld recognize this host's addresses under systemd

The unit's RestrictAddressFamilies lacked AF_NETLINK, which listing the
host's addresses needs, so the name server checks didn't know this
server's own addresses: the Name servers tab queried them like another
server's, and the delegation check didn't sign them with the view key.
Allow AF_NETLINK, and fall back to /proc/net without it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/nscheck/localaddr_test.go

@@ -0,0 +1,46 @@
+package nscheck
+
+import (
+	"net/netip"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+)
+
+// Without netlink (a sandboxed jarld), the host's addresses come from /proc.
+func TestProcAddrs(t *testing.T) {
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "if_inet6"), []byte(
+		"00000000000000000000000000000001 01 80 10 80       lo\n"+
+			"2a0280137f3d00100000000000000005 02 40 00 80     eth0\n"), 0o644)
+	os.WriteFile(filepath.Join(dir, "fib_trie"), []byte(`Main:
+  +-- 0.0.0.0/0 3 0 5
+     |-- 0.0.0.0
+        /0 universe UNICAST
+     +-- 10.0.10.0/24 2 0 2
+        |-- 10.0.10.0
+           /24 link UNICAST
+        |-- 10.0.10.5
+           /32 host LOCAL
+        |-- 10.0.10.255
+           /32 link BROADCAST
+Local:
+  +-- 0.0.0.0/0 3 0 5
+        |-- 10.0.10.5
+           /32 host LOCAL
+`), 0o644)
+	got := procAddrs(dir)
+	for _, want := range []string{"::1", "2a02:8013:7f3d:10::5", "10.0.10.5"} {
+		if !slices.Contains(got, netip.MustParseAddr(want)) {
+			t.Errorf("%s missing from %v", want, got)
+		}
+	}
+	if len(got) != 3 {
+		t.Errorf("got %v (10.0.10.5 once, no broadcast or network addresses)", got)
+	}
+	// And the real ones on this machine: at least loopback.
+	if len(procAddrs("/proc/net")) == 0 {
+		t.Log("no addresses in /proc/net here")
+	}
+}