- Running 'hyprkvm' without arguments now launches GUI (when built with --features gui)
- Shows helpful message with available commands when GUI not available
- Bump version to 0.6.0 for release

- Add home-manager module for declarative service management
- Users can now enable with: services.hyprkvm.enable = true
- Module supports settings for auto-generating config file
- Update contrib/systemd service for system-installed binary
- Remove dev template (users can manually adapt if needed)

Major fixes for edge barrier placement and cursor positioning in
multi-monitor setups:

- Calculate proper screen bounds (min_x, min_y, max_x, max_y) instead
  of just max coordinates
- Fix handle_enter to use actual screen bounds for cursor placement
- Fix initiate_transfer to calculate edge-relative position correctly
  with proper offset from screen origin
- Fix IPC Switch handler to use global screen bounds instead of
  focused monitor dimensions
- Fix capture.rs output position matching to use explicit tracking
  instead of checking for (0,0) coordinates
- Add direction negotiation in Hello handshake for automatic
  bidirectional config sync
- Add systemd service file for daemon management
- Add GUI for machine layout configuration (iced-based)

The direction sync allows peers to automatically update their config
when the other machine changes direction, triggering a restart to
rebuild edge barriers.

Provides a user service for managing the hyprkvm daemon via systemd.
Configured to auto-restart on exit code 75 (direction change).

Install to ~/.config/systemd/user/hyprkvm.service

Wayland compositors need axis_discrete events for mouse wheel scrolling.
Added axis_source(Wheel) and axis_discrete() calls with proper discrete
step calculation.

Modern mice use high-resolution scroll events at 120 units per notch.
Added support for REL_WHEEL_HI_RES and REL_HWHEEL_HI_RES with proper
scaling. Also added debug logging for scroll events.

Mouse buttons (BTN_LEFT, BTN_RIGHT, etc.) come through as Key events
but were being treated as keyboard keys. Now correctly identified and
forwarded as PointerButton events.

- Update workspace version from 0.1.0 to 0.5.0
- Remove unused GTK4/libadwaita deps from flake
- Add longDescription and mainProgram to package metadata

- Add SyncClipboardOutgoing transfer event
- Trigger clipboard sync on enter (after StartCapture)
- Trigger clipboard sync on leave (before Leave message)
- Add ClipboardManager initialization in daemon
- Handle ClipboardOffer/Request/Data messages
- Sync runs in spawned task to avoid blocking main loop

- ClipboardManager for offer/request/data flow
- Wayland access via wl-clipboard-rs (wlr-data-control protocol)
- SHA256 content hashing for deduplication
- MIME type prioritization (images > text)
- 64KB chunking for large content
- Support for text and image clipboard sync

- wl-clipboard-rs for Wayland clipboard access
- hex for content hash encoding
- base64 for clipboard data transfer

- Load known_hosts.toml on daemon startup
- Verify peer fingerprints on incoming and outgoing TLS connections
- Auto-save new peer fingerprints when TOFU is enabled
- Reject connections if fingerprint changed (potential MITM warning)
- Touch last_seen timestamp on successful verification

- Add tls.enabled config (default: false) for opt-in encryption
- Add per-neighbor tls override for mixed TLS/non-TLS environments
- Generate certificates on startup when TLS enabled
- Use TLS for server binding and outgoing connections based on config
- Print certificate fingerprint at startup for TOFU verification
- Clean up unused import warnings in network module

Implements TLS support with certificate pinning and TOFU:

- tls.rs: Certificate generation (ECDSA P-256), loading, fingerprint
  calculation (SHA-256), TLS acceptor/connector with custom verifier
- known_hosts.rs: TOFU storage for trusted fingerprints, persisted to
  ~/.config/hyprkvm/known_hosts.toml
- transport.rs: Updated to support both plain TCP and TLS connections
  with Stream enum wrapping TcpStream/TlsStream variants
- Added sha2 and time dependencies for crypto and cert validity

The transport layer now provides:
- Server::bind_tls() for TLS-enabled server
- connect_tls() for TLS client connections with fingerprint pinning
- Peer certificate fingerprint extraction after handshake

Integration with main.rs pending - this commit provides the foundation.

This commit fixes two major issues with CLI-initiated switches:

1. Prompt spam when running `hyprkvm-ctl switch`:
   - Filter non-keyboard/mouse devices (power buttons, game controllers, etc.)
   - Add 50ms delay before grabbing and 10ms between device grabs
   - Require >10 keys for keyboard detection (was >0)

2. Super key stuck after keyboard return from CLI switch:
   - Track `keyboard_initiated` flag through transfer state machine
   - Only send synthetic Super key-down for keyboard-initiated transfers
   - Add PostRecovery state to maintain synthetic Super via uinput
   - Keep virtual keyboard alive until physical Super key is released

The PostRecovery state ensures libinput knows Super is pressed after
ungrab, enabling subsequent Super+Arrow focus moves to work correctly.

Barrier integration:
- Add barrier checks to all edge transfer points
- Keyboard navigation, mouse edge, cursor edge all respect barrier
- IPC Move command blocked when barrier enabled (except return)

File logging:
- Add tracing-appender for dual output (stderr + file)
- Logs written to ~/.local/share/hyprkvm/daemon.log.YYYY-MM-DD
- Daily rotation with automatic file discovery in logs command

Reload command:
- Re-reads and validates config file
- Reports changes detected and whether restart required
- Checks machine name, listen port, and neighbor count

All CLI commands now functional:
- status, peers, ping (diagnostics)
- switch, return (control transfer)
- release, barrier on/off (input management)
- disconnect, reconnect (connection management)
- config show, reload, shutdown, logs (daemon management)

CLI Expansion (Sprint 6.5):
- switch: transfer control by direction or machine name
- return: return control to this machine
- release: force release input capture (recovery)
- barrier on/off: prevent cursor from leaving screen
- disconnect/reconnect: manage peer connections
- config show: display current configuration
- reload: hot-reload config (stub, not yet implemented)
- shutdown: graceful daemon shutdown
- logs: show daemon logs (needs file logging setup)

Protocol changes:
- Add SwitchTarget enum (Direction | MachineName)
- Add IpcRequest variants for all new commands
- Add IpcResponse::Ok, Config, Logs variants

Daemon handlers:
- Implement all new IPC request handlers
- Add barrier_enabled and shutdown_requested state flags
- Support IPC-triggered graceful shutdown

- Add IPC client to CLI with Unix socket communication
- Implement `status` command with uptime, state, connected peers
- Implement `peers` command with colored status indicators
- Implement `ping` command with latency measurement
- Add JSON output support (--json flag) for scripting
- Extend protocol with uptime_secs, machine_name, PeerInfo fields
- Add PingPeer IPC request with timeout handling in daemon

When control returns from remote machine, the local compositor never
saw key-up events for modifiers that were released while input was
grabbed. This caused "stuck" modifier state where the compositor
thought SUPER was still pressed, preventing keybinds from working.

Fix: send synthetic key-up events for all modifier keys (Shift, Ctrl,
Alt, Super) via virtual keyboard after stopping the input grab.

Also adds debug logging to IPC server for troubleshooting.