Stage 7: command-line helpers dsv, duser, dfw, dsys (0.5.0)

- das-helpers replaces the dsv package and adds shared functions in
  /usr/lib/das/helpers.sh (bilingual messages, sudo re-exec, prompts).
- dsv new creates a runit service (command, user, directory, environment,
  svlogd log) and checks it stays up; dsv rm deletes one not from a package.
- duser: list, add (installer groups, --admin, key, password), del, passwd,
  lock/unlock (key logins too), key add|list|rm, groups +/-.
- dfw: allow/deny/status/reload for the tcp_ports and udp_ports sets of the
  inet das table, kept in /etc/nftables.d/dfw.nft and checked with nft -c.
- dsys: info, hostname, timezone, locale, keymap.
- xtools-minimal on both images.
- nftables.conf no longer suggests restarting the nftables service: its
  finish script flushes the whole ruleset, fail2ban's and Docker's included.
- das-server-install 0.2.0 mentions the helpers when it finishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

srcpkgs/das-server/template

@@ -4,7 +4,7 @@ version=0.2.0
 revision=1
 depends="openssh chrony dhcpcd NetworkManager docker docker-compose nftables
  fail2ban socklog-void python3 curl lazydocker lazygit mc tmux htop
- das-snapshots das-update dsv"
+ das-snapshots das-update das-helpers xtools-minimal"
 short_desc="Das OS server: packages and secure defaults for SSH, firewall and Docker"
 maintainer="Das <anry.das@gmail.com>"
 license="MIT"
@@ -18,6 +18,7 @@ conf_files="
 
 do_install() {
 	vinstall ${FILESDIR}/nftables.conf 644 etc
+	vmkdir etc/nftables.d
 	vinstall ${FILESDIR}/fail2ban-das.conf 644 etc/fail2ban/jail.d das.conf
 	vinstall ${FILESDIR}/sshd-das.conf 644 etc/ssh/sshd_config.d 50-das.conf
 	vinstall ${FILESDIR}/docker-daemon.json 644 etc/docker daemon.json