feat(daemon): D-Bus interface with all 9 stub methods + system-bus wiring

Bundles plan tasks 1.8 (read methods), 1.9 (EnrollOwn/RemoveOwn with polkit
gate), 1.10 (EnrollOther, SetPolicy, pending, recovery-code), and 1.11
(main.rs system-bus registration) — they land together because Polkit::System
is only constructed by main.rs, so splitting them mid-implementation would
require dead_code allows that immediately reverse.

Adds:
- daemon/src/dbus.rs — AuthForge struct + #[zbus::interface] impl with all 9
  methods. Reads (ListCredentials, GetPolicy) are unauthenticated; writes call
  authz() which dispatches to polkit. Includes 9 integration tests via a
  tokio::net::UnixStream::pair p2p connection — no system bus needed for tests.
- daemon/src/main.rs — connects to system bus, picks Polkit::system or
  Polkit::permissive based on AUTHFORGE_POLKIT_BYPASS env var, registers the
  AuthForge interface at /io/dangerousthings/AuthForge, requests well-known
  name io.dangerousthings.AuthForge, then parks forever.
- daemon/src/polkit.rs — drop dead_code allows now that System is wired.
- daemon/src/state.rs — gate has_pending() behind cfg(test); production reads
  go through the on-disk file in later phases, not this in-memory cache.
- common/src/types.rs (formatting only via rustfmt).

Tests: 14/14 daemon tests pass (4 state, 1 polkit, 9 dbus). 7/7 common tests
pass. cargo clippy --workspace --all-targets -D warnings clean. cargo fmt
clean.

daemon/src/main.rs

@@ -1,15 +1,48 @@
-use anyhow::Result;
-use tracing::info;
+use anyhow::{Context, Result};
+use std::sync::Arc;
+use tracing::{info, warn};
 
+mod dbus;
 mod polkit;
 mod state;
 
+const BUS_NAME: &str = "io.dangerousthings.AuthForge";
+const OBJECT_PATH: &str = "/io/dangerousthings/AuthForge";
+
 #[tokio::main]
 async fn main() -> Result<()> {
     tracing_subscriber::fmt()
         .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
         .init();
     info!("authforged {} starting", env!("CARGO_PKG_VERSION"));
-    // D-Bus service registration in Phase 1.
+
+    let conn = zbus::Connection::system()
+        .await
+        .context("connecting to system D-Bus")?;
+
+    let polkit = if std::env::var("AUTHFORGE_POLKIT_BYPASS").is_ok() {
+        warn!(
+            "AUTHFORGE_POLKIT_BYPASS set — polkit checks are DISABLED. Do not use in production."
+        );
+        polkit::Polkit::permissive()
+    } else {
+        polkit::Polkit::system(conn.clone()).await
+    };
+
+    let state = Arc::new(state::AppState::with_fixtures());
+    let auth = dbus::AuthForge {
+        state: state.clone(),
+        polkit: Arc::new(polkit),
+    };
+
+    conn.object_server().at(OBJECT_PATH, auth).await?;
+    conn.request_name(BUS_NAME)
+        .await
+        .context("acquiring well-known bus name (another instance running?)")?;
+
+    info!("listening on D-Bus as {BUS_NAME} at {OBJECT_PATH}");
+
+    // Park forever. systemd will SIGTERM the process when stopping the unit.
+    std::future::pending::<()>().await;
     Ok(())
 }