- Add scale field to input::MonitorInfo to use actual Hyprland scale
- Fix output-to-monitor matching to use real scale instead of guessing
- Calculate screen bounds in logical coordinates (cursor_pos uses logical)
- Add cursor position verification using Hyprland IPC

This fixes edge barriers not triggering on scaled monitors where the
physical vs logical coordinate mismatch caused the edge check to fail.

- Running 'hyprkvm' without arguments now launches GUI (when built with --features gui)
- Shows helpful message with available commands when GUI not available
- Bump version to 0.6.0 for release

- Add home-manager module for declarative service management
- Users can now enable with: services.hyprkvm.enable = true
- Module supports settings for auto-generating config file
- Update contrib/systemd service for system-installed binary
- Remove dev template (users can manually adapt if needed)

Major fixes for edge barrier placement and cursor positioning in
multi-monitor setups:

- Calculate proper screen bounds (min_x, min_y, max_x, max_y) instead
  of just max coordinates
- Fix handle_enter to use actual screen bounds for cursor placement
- Fix initiate_transfer to calculate edge-relative position correctly
  with proper offset from screen origin
- Fix IPC Switch handler to use global screen bounds instead of
  focused monitor dimensions
- Fix capture.rs output position matching to use explicit tracking
  instead of checking for (0,0) coordinates
- Add direction negotiation in Hello handshake for automatic
  bidirectional config sync
- Add systemd service file for daemon management
- Add GUI for machine layout configuration (iced-based)

The direction sync allows peers to automatically update their config
when the other machine changes direction, triggering a restart to
rebuild edge barriers.

Provides a user service for managing the hyprkvm daemon via systemd.
Configured to auto-restart on exit code 75 (direction change).

Install to ~/.config/systemd/user/hyprkvm.service

Wayland compositors need axis_discrete events for mouse wheel scrolling.
Added axis_source(Wheel) and axis_discrete() calls with proper discrete
step calculation.

Modern mice use high-resolution scroll events at 120 units per notch.
Added support for REL_WHEEL_HI_RES and REL_HWHEEL_HI_RES with proper
scaling. Also added debug logging for scroll events.

Mouse buttons (BTN_LEFT, BTN_RIGHT, etc.) come through as Key events
but were being treated as keyboard keys. Now correctly identified and
forwarded as PointerButton events.

- Update workspace version from 0.1.0 to 0.5.0
- Remove unused GTK4/libadwaita deps from flake
- Add longDescription and mainProgram to package metadata

- Add SyncClipboardOutgoing transfer event
- Trigger clipboard sync on enter (after StartCapture)
- Trigger clipboard sync on leave (before Leave message)
- Add ClipboardManager initialization in daemon
- Handle ClipboardOffer/Request/Data messages
- Sync runs in spawned task to avoid blocking main loop

- ClipboardManager for offer/request/data flow
- Wayland access via wl-clipboard-rs (wlr-data-control protocol)
- SHA256 content hashing for deduplication
- MIME type prioritization (images > text)
- 64KB chunking for large content
- Support for text and image clipboard sync

- wl-clipboard-rs for Wayland clipboard access
- hex for content hash encoding
- base64 for clipboard data transfer

- Load known_hosts.toml on daemon startup
- Verify peer fingerprints on incoming and outgoing TLS connections
- Auto-save new peer fingerprints when TOFU is enabled
- Reject connections if fingerprint changed (potential MITM warning)
- Touch last_seen timestamp on successful verification

- Add tls.enabled config (default: false) for opt-in encryption
- Add per-neighbor tls override for mixed TLS/non-TLS environments
- Generate certificates on startup when TLS enabled
- Use TLS for server binding and outgoing connections based on config
- Print certificate fingerprint at startup for TOFU verification
- Clean up unused import warnings in network module

Implements TLS support with certificate pinning and TOFU:

- tls.rs: Certificate generation (ECDSA P-256), loading, fingerprint
  calculation (SHA-256), TLS acceptor/connector with custom verifier
- known_hosts.rs: TOFU storage for trusted fingerprints, persisted to
  ~/.config/hyprkvm/known_hosts.toml
- transport.rs: Updated to support both plain TCP and TLS connections
  with Stream enum wrapping TcpStream/TlsStream variants
- Added sha2 and time dependencies for crypto and cert validity

The transport layer now provides:
- Server::bind_tls() for TLS-enabled server
- connect_tls() for TLS client connections with fingerprint pinning
- Peer certificate fingerprint extraction after handshake

Integration with main.rs pending - this commit provides the foundation.

This commit fixes two major issues with CLI-initiated switches:

1. Prompt spam when running `hyprkvm-ctl switch`:
   - Filter non-keyboard/mouse devices (power buttons, game controllers, etc.)
   - Add 50ms delay before grabbing and 10ms between device grabs
   - Require >10 keys for keyboard detection (was >0)

2. Super key stuck after keyboard return from CLI switch:
   - Track `keyboard_initiated` flag through transfer state machine
   - Only send synthetic Super key-down for keyboard-initiated transfers
   - Add PostRecovery state to maintain synthetic Super via uinput
   - Keep virtual keyboard alive until physical Super key is released

The PostRecovery state ensures libinput knows Super is pressed after
ungrab, enabling subsequent Super+Arrow focus moves to work correctly.