Add npackd local service layer (roadmap Phase 2, first slice)

[imattau]

Summary

• Adds npack daemon [--socket <path>], running npackd: a JSON-RPC-over-Unix-socket service (newline-delimited JSON, defaulting to $XDG_RUNTIME_DIR/npackd.sock) exposing Search, GetPackage, ListInstalled, Install, Remove, Update, and CheckUpdates, so a GUI store or other tool can talk to npack without understanding Nostr, Blossom, or .npk internals.
• GetPackage/Search/CheckUpdates reuse the existing resolve_release/search_matching_releases (newly extracted from search_releases, which now just prints its results) logic directly rather than reimplementing it; Install/Remove/Update call the existing install_remote_command/remove_package_at functions and report structured results back over the socket.
• Design choice: Unix socket over D-Bus for this first slice — no new system/session-bus dependency, so it behaves the same in minimal and containerized environments. A D-Bus adapter in front of the same handlers remains possible if a later desktop-store phase needs it.
• Scope choice: no transaction/progress-event streaming yet — connections are handled one at a time (the recursive dependency-install future is not Send, ruling out tokio::spawn), and a client gets the final result once an Install/Update completes. GetTransaction/CancelTransaction are left for a later slice.

Test plan

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features (no warnings)
• cargo test (46 passing, including a new end-to-end daemon test over a real Unix socket)
• Manual smoke test over a real socket with nc -U: ListInstalled/Remove against a real installed package, GetPackage against npack's own real production Nostr/Blossom release, and an unknown-method error path — all verified working

Follow-up (tracked in the roadmap)

• Streamed progress/transaction events and CancelTransaction for long-running installs.
• Concurrent connection handling (currently one at a time).

🤖 Generated with Claude Code