Milestone 3: iroh endpoint, tickets, pin-triggered fetch

The daemon binds an iroh endpoint (ed25519 identity at secret.key,
0600), serves its store via Blobs/Router on the standard ALPN, and
fetches with the iroh-blobs Downloader rather than the rpc client to
keep quic-rpc out of the tree. Relay is disabled unless wan_upload is
set: LAN-only, zero WAN upload by default. TicketImport pins first
(the pin is the GC root protecting in-flight data), registers the
ticket's NodeAddr with the endpoint (the downloader dials by NodeId
alone), then fetches in the background; completion emits pin_complete.

Tests: two-daemon localhost transfers (blob + directory collection,
byte-identical), and kill -9 mid-transfer followed by restart on the
same store resuming to completion.

Dependencies: iroh 0.35 (endpoint/router, pairs with iroh-blobs 0.35),
rand 0.8 (secret key generation, same version iroh uses).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

varde-daemon/src/main.rs

@@ -90,8 +90,8 @@ async fn run(config: Config) -> Result<()> {
         r = shutdown_signal() => r.map(|signal| info!(signal, "shutting down")),
     };
 
-    // Flush the store and remove the socket so the next start is clean.
-    daemon.store().shutdown().await;
+    // Close the endpoint, flush the store, remove the socket.
+    daemon.shutdown().await;
     let _ = std::fs::remove_file(&socket_path);
     result
 }