[daemon] add optional backend bridge for future socket API service

[yoshi3jp]

Summary

This introduces the first native-side foundation for a future external
droidspaces-socketd service. Provided that this PR is accepted, the development of the endpoint for the following purpose will commence.

The intended long-term goal is to allow Droidspaces to expose a
Podman-style Docker Engine API compatibility service, suitable for tools
such as Portainer, without pulling HTTP/JSON/C++ concerns into the existing
native runtime.

This PR does not implement the public Docker-compatible API yet.
Instead, it adds a small, opt-in, private backend bridge inside the existing
privileged Droidspaces daemon that a future C++ socket daemon can use.

Motivation

Droidspaces already has the correct privileged execution context for
container lifecycle and inspection operations:

• namespace-sensitive operations are already handled by the existing daemon;
• Android-specific SELinux and root-manager constraints are already handled there;
• the native runtime already owns container discovery, lifecycle, and recovery logic.

Rather than duplicating that logic in a new public-facing service, the planned
architecture is:

Portainer / Docker-compatible clients
        │
        ▼
droidspaces-socketd
  - C++
  - HTTP + JSON
  - Docker Engine API compatibility layer
        │
        ▼
private Droidspaces backend bridge
        │
        ▼
existing privileged Droidspaces daemon

This keeps the current native runtime focused and avoids leaking C++ or
public API-server concerns into the existing C codebase.

What this PR adds

1. Optional build gate

A new build flag is introduced:

ENABLE_SOCKETD_BACKEND=1

The bridge is disabled by default, so normal Droidspaces builds remain unchanged.

Example:

make aarch64

builds the existing runtime as before.

make aarch64 ENABLE_SOCKETD_BACKEND=1

builds the runtime with the private socketd backend bridge enabled.

2. Private backend socket bridge

When enabled, the existing Droidspaces daemon starts a small helper process
that listens on a private abstract Unix socket:

@droidspaces-socketd-backend

This is not the future public Portainer-facing socket. It is an internal
control path intended only for the future droidspaces-socketd process.

3. Versioned framed protocol

The new files:

src/socketd_protocol.h
src/socketd_bridge.h
src/socketd_bridge.c

define a small request/response protocol with:

• magic number;
• protocol version;
• opcode;
• payload length;
• explicit response status.

The protocol header is written to be safely usable from both C and C++, so the
future external daemon can share it without introducing C++ into the native
runtime.

4. Initial backend operations

This PR implements only the protocol bootstrap operations:

• PING
• CAPABILITIES

Container-oriented operations are reserved in the protocol for follow-up work:

• INFO
• LIST_CONTAINERS
• INSPECT_CONTAINER
• START_CONTAINER
• STOP_CONTAINER
• RESTART_CONTAINER

These currently return UNSUPPORTED.

5. Basic local peer restriction

The backend socket currently accepts only:

• root peers; or
• peers running under the same effective UID as the daemon.

This is intentionally conservative because the bridge is a privileged local
control interface.