Sync omarchy-air's handoff work: pointer patch, firewall, case fix

Everything from the air side of lan-mouse that was living only on that
machine, plus corrections to what this repo already said.

New: handoff/patch/ is a two-line source patch making the daemon forward
the ACCELERATED pointer deltas. Upstream 0.11.0 forwards dx_unaccel and
discards the accelerated pair in the same event, and the wlr receiver
applies no curve either, so remote motion arrives with the sender's
acceleration stripped and nothing replacing it -- and sensitivity /
accel_profile are inert on both ends, so no config can fix it. The patch
also adds LAN_MOUSE_POINTER_SCALE for the residual logical-ppi gap
(0.7 for air's 140.1ppi against the LG's ~95.8). install.sh builds it
per-machine; the unit now runs the result. This laptop is still unpatched,
so its forwarded motion is still wrong until the handoff step runs here.

New: install.sh --handoff opens 4242/udp for the peer in ufw. ufw is
default-deny inbound and a dropped inbound packet presents IDENTICALLY to
a bad certificate; this cost a day. Nothing in the repo covered it.

Fixed: cmd_restart bypassed the systemd unit with pkill + uwsm-app, which
races Restart=on-failure and can leave two daemons on 4242. It now prefers
the unit, matching what cmd_log already assumed, and keeps the hand-start
path only for when no unit exists.

Documented, and this was the actual root cause of a day of dead crossings:
fingerprints are CASE-SENSITIVE. lan-mouse generates them lowercase and
compares with a plain map lookup, while openssl prints uppercase and
cli authorize-key stores what it is handed. An uppercase digest is the
right digest, valid TOML, non-empty, passes every guard, and never
matches -- the handshake dies bad_certificate. Also documented:
authorization is receiver-side only (connect.rs sets insecure_skip_verify),
so each direction depends solely on the receiver's list and a sender cannot
tell whether it is talking to the real peer.

Corrected: README claimed the unknown-device* accel rule was needed because
the receiver double-accelerates already-accelerated deltas. That is backwards
and the rule is a measured no-op -- the device matches, but sensitivity and
accel_profile are libinput settings and a wlr-virtual-pointer is not a
libinput device. Measured on both machines: 398x198px travel at
sensitivity 0 and identical at -0.9, exactly 1:1. Lines kept (harmless, and
the naming note is worth having) with the real mechanism written down.

~/.config/lan-mouse/ stays out of the repo as before; handoff/config/ holds
example configs carrying the backend, edge and lowercase rules instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LrgrMhPG8CTo9XZF326rjZ

packages.txt

@@ -14,6 +14,9 @@
 # pipewire-debug) which is out of this repo's scope.
 
 [repo]
+# --- omarchy-handoff: builds the patched lan-mouse daemon (handoff/patch/) ---
+rust                     # only to compile handoff/patch/; ~250MiB installed, removable after
+
 # --- hardware: this laptop is Intel + an Anker USB-C dock ---
 linux-omarchy            # kernel this install actually boots
 linux-omarchy-headers    # needed to build out-of-tree modules against it