Feature: Desktop notifications when a VPN connects or disconnects

Adds the vpn-notify script and its systemd user service, which notify on
WireGuard/tun/Tailscale changes and reconnect NetworkManager WireGuard
tunnels after a network switch. bootstrap.sh now enables the service and
packages.txt lists libnotify explicitly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bootstrap.sh

@@ -172,12 +172,18 @@ step "Linking dotfiles with stow"
 mkdir -p "$HOME/.config" "$HOME/.local/bin" "$HOME/.local/share/fonts" "$HOME/Pictures"
 # Sunshine keeps credentials and logs beside its config; those must stay out of git
 mkdir -p "$HOME/.config/sunshine"
+# systemd keeps its own wants/ symlinks beside the stowed user units
+mkdir -p "$HOME/.config/systemd/user"
 mkdir -p -m 700 "$HOME/.ssh"
 if ! stow -d "$repo" -t "$HOME" --restow dotfiles; then
     echo "stow hit conflicts (listed above). Move those files aside, then run:" >&2
     echo "  stow -d \"$repo\" -t \"\$HOME\" dotfiles" >&2
 fi
 
+step "Enabling user services"
+systemctl --user daemon-reload
+systemctl --user enable vpn-notify.service
+
 if [[ "$(getent passwd "$USER" | cut -d: -f7)" != */zsh ]]; then
     step "Setting zsh as login shell"
     chsh -s /usr/bin/zsh