Put and Read: content on the socket, for clients that share no files

The system daemon runs as its own user behind ProtectHome, so it can
neither read a file a desktop app wrote for Add nor write one back for
Materialize - redoal on the system varde failed every get with EACCES.
Put imports base64 bytes carried in the request and Read returns a raw
blob's bytes in the reply, both up to MAX_INLINE_BYTES (16 MiB).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

varde-daemon/src/store.rs

@@ -228,6 +228,30 @@ impl BlobStore {
 
     /// Export `hash` to `dest`. Returns bytes written and whether at least
     /// one file was reflinked.
+    /// Import `data` as one raw blob (`Request::Put`).
+    pub async fn add_bytes(&self, data: Vec<u8>) -> Result<(Hash, u64), OpError> {
+        let size = data.len() as u64;
+        let tag = self.store.add_bytes(data).temp_tag().await.map_err(internal)?;
+        info!(hash = %tag.hash().to_hex(), size, "imported bytes");
+        Ok((tag.hash(), size))
+    }
+
+    /// The whole content of a complete raw blob (`Request::Read`), when it
+    /// is no larger than `limit`.
+    pub async fn read_bytes(&self, hash: Hash, limit: u64) -> Result<Vec<u8>, OpError> {
+        match self.store.blobs().status(hash).await.map_err(internal)? {
+            BlobStatus::Complete { size } if size > limit => Err(OpError::InvalidArgument(format!(
+                "{} is {size} bytes, more than {limit} can be read inline; materialize it",
+                hash.to_hex()
+            ))),
+            BlobStatus::Complete { .. } => {
+                let bytes = self.store.blobs().get_bytes(hash).await.map_err(internal)?;
+                Ok(bytes.to_vec())
+            }
+            _ => Err(OpError::NotFound(format!("{} is not complete in the store", hash.to_hex()))),
+        }
+    }
+
     pub async fn materialize(
         &self,
         hash: Hash,