feat(torad): route source fetches through the tunnel and package VPN mode

Three things, all tail end of VPN mode.

Source fetches are HTTP, not BitTorrent, so librqbit's SO_BINDTODEVICE
never covered them. SourceResolver now holds two clients and picks one
per URL: remote indexer and .torrent fetches go through a client bound
to wg0, so a future route change cannot quietly send them around the
tunnel; loopback URLs keep the unbound client, because pasta splices the
namespace's loopback to the host's and that is how a self-hosted Jackett
stays reachable. That traffic never leaves the machine, so keeping it off
the tunnel is deliberate.

This replaces the planned request-time URL rewriting, which turned out to
be unnecessary: measured, pasta reaches host services on 127.0.0.1 from
inside the namespace even when they bind after the namespace starts, so
neither Jackett URLs nor a loopback DATABASE_URL need touching.

Second, a defect the packaging work surfaced: killing the pid in the pid
file killed pasta but left torad running, reparented to init, with a dead
tap interface -- the daemon outliving the only documented way to stop it.
The re-executed process now sets PR_SET_PDEATHSIG so it dies with pasta.

Third, packaging: passt, wireguard-go and iproute2 in both devenv files,
and the module documentation states the Linux-only, leech-only and
pinned-endpoint limitations along with what happens when the tunnel drops.
wireguard-tools is deliberately absent -- the device is configured over
UAPI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

devenv.nix

@@ -55,6 +55,18 @@ in
     buf
     grpcurl
 
+    # VPN mode (torad --wireguard-config). Both are runtime dependencies torad
+    # execs, not build inputs.
+    #   passt        -> `pasta`, which creates the unprivileged user+network
+    #                   namespace torad re-executes itself into.
+    #   wireguard-go -> the userspace WireGuard datapath.
+    # `wireguard-tools` is deliberately absent: torad configures the device by
+    # speaking the UAPI protocol over its socket, so no `wg` binary is needed.
+    # `iproute2` provides the `ip` used for the tunnel address and routes.
+    passt
+    wireguard-go
+    iproute2
+
     # Protobuf generators
     protoc-gen-prost-crate
     protoc-gen-prost-serde
@@ -80,6 +92,11 @@ in
   env.TORAD_PID_FILE = "${config.env.DEVENV_RUNTIME}/torad.pid";
 
   processes.torad = {
+    # VPN mode is opt-in so the default `devenv up` is unchanged: set
+    # TORAD_WIREGUARD_CONFIG to a wg-quick config path and torad will re-exec
+    # itself into a namespace and route all torrent traffic through the tunnel.
+    # torad reads that variable itself (clap `env`), so nothing is needed here
+    # beyond leaving it unset by default.
     exec = ''
       ${config.outputs.torad}/bin/torad --socket "$TORAD_SOCKET" --pid-file "$TORAD_PID_FILE"
     '';