Stage 7: command-line helpers dsv, duser, dfw, dsys (0.5.0)

- das-helpers replaces the dsv package and adds shared functions in
  /usr/lib/das/helpers.sh (bilingual messages, sudo re-exec, prompts).
- dsv new creates a runit service (command, user, directory, environment,
  svlogd log) and checks it stays up; dsv rm deletes one not from a package.
- duser: list, add (installer groups, --admin, key, password), del, passwd,
  lock/unlock (key logins too), key add|list|rm, groups +/-.
- dfw: allow/deny/status/reload for the tcp_ports and udp_ports sets of the
  inet das table, kept in /etc/nftables.d/dfw.nft and checked with nft -c.
- dsys: info, hostname, timezone, locale, keymap.
- xtools-minimal on both images.
- nftables.conf no longer suggests restarting the nftables service: its
  finish script flushes the whole ruleset, fail2ban's and Docker's included.
- das-server-install 0.2.0 mentions the helpers when it finishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

srcpkgs/das-helpers/files/dfw.bash-completion

@@ -0,0 +1,22 @@
+# bash completion for dfw
+# shellcheck shell=bash
+_dfw() {
+	local cur=${COMP_WORDS[COMP_CWORD]}
+	if ((COMP_CWORD == 1)); then
+		mapfile -t COMPREPLY < <(compgen -W "status allow deny reload help" -- "$cur")
+		return
+	fi
+	case ${COMP_WORDS[1]} in
+	deny)
+		# The ports opened with dfw
+		local ports
+		ports=$(sed -n 's/^add element inet das \(tcp\|udp\)_ports { \(.*\) }$/\2 \1/p' /etc/nftables.d/dfw.nft 2>/dev/null |
+			awk '{ for (i = 1; i < NF; i++) { p = $i; sub(/,$/, "", p); print p "/" $NF } }')
+		mapfile -t COMPREPLY < <(compgen -W "$ports" -- "$cur")
+		;;
+	allow)
+		mapfile -t COMPREPLY < <(compgen -W "http https 80/tcp 443/tcp 53/udp" -- "$cur")
+		;;
+	esac
+}
+complete -F _dfw dfw