feat(daemon): D-Bus interface with all 9 stub methods + system-bus wiring

Bundles plan tasks 1.8 (read methods), 1.9 (EnrollOwn/RemoveOwn with polkit
gate), 1.10 (EnrollOther, SetPolicy, pending, recovery-code), and 1.11
(main.rs system-bus registration) — they land together because Polkit::System
is only constructed by main.rs, so splitting them mid-implementation would
require dead_code allows that immediately reverse.

Adds:
- daemon/src/dbus.rs — AuthForge struct + #[zbus::interface] impl with all 9
  methods. Reads (ListCredentials, GetPolicy) are unauthenticated; writes call
  authz() which dispatches to polkit. Includes 9 integration tests via a
  tokio::net::UnixStream::pair p2p connection — no system bus needed for tests.
- daemon/src/main.rs — connects to system bus, picks Polkit::system or
  Polkit::permissive based on AUTHFORGE_POLKIT_BYPASS env var, registers the
  AuthForge interface at /io/dangerousthings/AuthForge, requests well-known
  name io.dangerousthings.AuthForge, then parks forever.
- daemon/src/polkit.rs — drop dead_code allows now that System is wired.
- daemon/src/state.rs — gate has_pending() behind cfg(test); production reads
  go through the on-disk file in later phases, not this in-memory cache.
- common/src/types.rs (formatting only via rustfmt).

Tests: 14/14 daemon tests pass (4 state, 1 polkit, 9 dbus). 7/7 common tests
pass. cargo clippy --workspace --all-targets -D warnings clean. cargo fmt
clean.

common/src/types.rs

@@ -1,9 +1,7 @@
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 
-#[derive(
-    Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, zvariant::Type,
-)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
 #[serde(rename_all = "lowercase")]
 #[zvariant(signature = "s")]
 pub enum Mode {
@@ -12,9 +10,7 @@ pub enum Mode {
     Required,
 }
 
-#[derive(
-    Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, zvariant::Type,
-)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, zvariant::Type)]
 #[serde(rename_all = "lowercase")]
 #[zvariant(signature = "s")]
 pub enum Method {
@@ -22,9 +18,7 @@ pub enum Method {
     Totp,
 }
 
-#[derive(
-    Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, zvariant::Type,
-)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, zvariant::Type)]
 #[serde(rename_all = "lowercase")]
 #[zvariant(signature = "s")]
 pub enum Transport {
@@ -43,9 +37,7 @@ pub struct Credential {
     pub created_unix: u64,
 }
 
-#[derive(
-    Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, zvariant::Type, Default,
-)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, zvariant::Type, Default)]
 #[serde(rename_all = "kebab-case")]
 #[zvariant(signature = "s")]
 pub enum StorageBackend {
@@ -141,7 +133,10 @@ mod tests {
         let mut p = Policy::default();
         p.stacks.insert(
             "sudo".to_string(),
-            StackPolicy { mode: Mode::Required, methods: vec![Method::Fido2] },
+            StackPolicy {
+                mode: Mode::Required,
+                methods: vec![Method::Fido2],
+            },
         );
         let json = serde_json::to_string(&p).unwrap();
         let back: Policy = serde_json::from_str(&json).unwrap();
@@ -163,7 +158,10 @@ mod tests {
 
     #[test]
     fn policy_apply_result_ok_no_violations() {
-        let r = PolicyApplyResult { applied: true, violations: vec![] };
+        let r = PolicyApplyResult {
+            applied: true,
+            violations: vec![],
+        };
         assert!(r.applied);
         assert!(r.violations.is_empty());
     }