feat: systemd user service file for headless deployment

Hardened unit with ProtectSystem/ProtectHome, auto-restart on failure,
and ExecReload for SIGHUP hot config reload. Docs updated with setup,
management, and enable-linger instructions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

TODO.md

@@ -3,14 +3,12 @@
 ## Features
 
 - [ ] Web status dashboard
-- [ ] DCC passthrough
 - [ ] Per-client backlog tracking (multi-user)
 - [ ] Farm: configurable ephemeral deadline
 - [ ] Farm: per-network enable/disable override
 
 ## Infrastructure
 
-- [ ] Systemd unit file
 - [ ] Containerfile for podman deployment
 - [ ] PyPI packaging