feat: add AF_VSOCK listener

[cablehead]

Adds a third transport alongside TCP and Unix domain sockets, so a Cloud Hypervisor / libkrun guest can expose http-nu over AF_VSOCK and the host can bridge it to a unix socket.

Usage

• http-nu vsock://80 serve.nu (also accepts vsock://<cid>:<port>; always binds VMADDR_CID_ANY)

Details

• Linux-only, behind the vsock cargo feature (in default); tokio-vsock is target-gated so macOS/Windows still build with the feature inert.
• accept returns no peer address, like the UDS path: remote_ip/remote_port stay absent and --trust-proxy keeps resolving X-Forwarded-For without panicking.
• Startup banner prints vsock://:<port>.
• remote_vsock: {cid, port} metadata deferred for now.

Verification

• Builds with and without the vsock feature (code fully gated).
• test_bind_vsock round-trips over the host-local CID (1), no hypervisor needed.
• cargo clippy --all-features -D warnings clean.