Stage 7: command-line helpers dsv, duser, dfw, dsys (0.5.0)

- das-helpers replaces the dsv package and adds shared functions in
  /usr/lib/das/helpers.sh (bilingual messages, sudo re-exec, prompts).
- dsv new creates a runit service (command, user, directory, environment,
  svlogd log) and checks it stays up; dsv rm deletes one not from a package.
- duser: list, add (installer groups, --admin, key, password), del, passwd,
  lock/unlock (key logins too), key add|list|rm, groups +/-.
- dfw: allow/deny/status/reload for the tcp_ports and udp_ports sets of the
  inet das table, kept in /etc/nftables.d/dfw.nft and checked with nft -c.
- dsys: info, hostname, timezone, locale, keymap.
- xtools-minimal on both images.
- nftables.conf no longer suggests restarting the nftables service: its
  finish script flushes the whole ruleset, fail2ban's and Docker's included.
- das-server-install 0.2.0 mentions the helpers when it finishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

srcpkgs/das-helpers/files/duser.bash-completion

@@ -0,0 +1,42 @@
+# bash completion for duser
+# shellcheck shell=bash
+_duser_users() {
+	local min max
+	min=$(awk '$1 == "UID_MIN" { print $2 }' /etc/login.defs 2>/dev/null)
+	max=$(awk '$1 == "UID_MAX" { print $2 }' /etc/login.defs 2>/dev/null)
+	getent passwd | awk -F: -v min="${min:-1000}" -v max="${max:-60000}" '$3 >= min && $3 <= max { print $1 }'
+}
+
+_duser() {
+	local cur=${COMP_WORDS[COMP_CWORD]} cmd=${COMP_WORDS[1]:-}
+	if ((COMP_CWORD == 1)); then
+		mapfile -t COMPREPLY < <(compgen -W "list add del passwd lock unlock key groups help" -- "$cur")
+		return
+	fi
+	case $cmd in
+	add)
+		if [[ ${COMP_WORDS[COMP_CWORD - 1]} == --key ]]; then
+			mapfile -t COMPREPLY < <(compgen -f -- "$cur")
+		else
+			mapfile -t COMPREPLY < <(compgen -W "--admin --key --no-password --password-stdin" -- "$cur")
+		fi
+		;;
+	del | passwd | lock | unlock | key | groups)
+		if ((COMP_CWORD == 2)); then
+			mapfile -t COMPREPLY < <(compgen -W "$(_duser_users)" -- "$cur")
+		elif [[ $cmd == del ]]; then
+			mapfile -t COMPREPLY < <(compgen -W "--home" -- "$cur")
+		elif [[ $cmd == key ]] && ((COMP_CWORD == 3)); then
+			mapfile -t COMPREPLY < <(compgen -W "list add rm" -- "$cur")
+		elif [[ $cmd == key && ${COMP_WORDS[3]} == add ]]; then
+			mapfile -t COMPREPLY < <(compgen -f -- "$cur")
+		elif [[ $cmd == groups ]]; then
+			# +GROUP and -GROUP
+			local sign=${cur:0:1}
+			[[ $sign == [+-] ]] || sign=+
+			mapfile -t COMPREPLY < <(compgen -P "$sign" -W "$(getent group | cut -d: -f1)" -- "${cur#[+-]}")
+		fi
+		;;
+	esac
+}
+complete -F _duser duser