feat(cli): auto-NAT + privilege drop + Windows named-pipe admin

Three v2-hardening features in aura-cli, one pass:

- nat::NatGuard: RAII auto-config of IP forwarding + MASQUERADE on server
  startup. Linux (sysctl ip_forward + iptables -t nat MASQUERADE) and
  macOS (sysctl ip.forwarding + pfctl with /tmp/aura-nat.conf). dry_run
  works on every platform (logs "would run: ..."). Reverts everything in
  Drop. New [server.nat] {auto, egress_iface, dry_run}; absent section =
  back-compat no-op. Removes v1's "manual NAT/forwarding" step.
- privdrop::drop_to_user: drop euid/gid after binding TUN + privileged
  ports. Linux setresuid/setresgid, macOS setgid+setuid (permanent drop),
  Windows no-op with warning. New [server] / [client] run_as = "..."
  (optional). Skipped with info-log if already non-root.
- admin: split transport into cfg(unix) Unix-socket and cfg(windows) Tokio
  named-pipe modules sharing one JSON-line serve/request flow over
  AsyncRead/AsyncWrite. DEFAULT_SOCKET = "/tmp/aura-admin.sock" on Unix,
  r"\\.\pipe\aura-admin" on Windows. Removes v1's "admin Unix-only".

Deps: nix 0.29 user feature under [target.'cfg(unix)'.dependencies] (cli-
local, not workspace). Workspace: 155 tests passed (+13), clippy -D warnings
clean, fmt clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

crates/aura-cli/Cargo.toml

@@ -32,6 +32,14 @@ tracing-subscriber.workspace = true
 anyhow.workspace = true
 uuid.workspace = true
 
+# Unix-only: nix is used by the privilege-drop helper (`privdrop::drop_to_user`) to look up
+# the target user via getpwnam and drop the real/effective/saved uid+gid after binding
+# privileged sockets / creating the TUN. Linux uses setresuid/setresgid; macOS uses
+# setgid/setuid (no setresuid in the BSD ABI). The "user" feature gates the User::from_name
+# helper. No nix on Windows (privilege drop is a no-op there; see privdrop.rs).
+[target.'cfg(unix)'.dependencies]
+nix = { version = "0.29", default-features = false, features = ["user"] }
+
 [dev-dependencies]
 tokio.workspace = true
 # Loopback + PKI-roundtrip tests build certificate chains for the verifier.