Switch from --netfilter to --iptables mode so Jool only processes
container traffic. --netfilter mode intercepts all packets to
64:ff9b::/96, breaking upstream NAT64 (e.g., Android hotspot tethering).

Show OK/Cancel/Clear cache options instead of confusing menu.
Add -only-match to prevent typing from breaking selection.

Uses NixOS services.radicle module with clan vars for key management.
Configures SOCKS proxy for .onion seed connectivity.

- Cache PIN in kernel keyring (keyctl) for 5 minutes with sliding window
- Show menu to use cached PIN or clear cache when cache exists
- Escape <, >, & in SSH args for pango markup (fixes empty prompt with
commands containing redirections like 2>/dev/null)

Add a rofi-based pinentry for TPM SSH authentication that displays
the SSH command being authenticated (destination, flags, arguments).

- Patch ssh-tpm-agent to pass client PID via SSH_CLIENT_PID env var
using SO_PEERCRED on the Unix socket
- New pinentry-rofi tool reads /proc/<pid>/cmdline to show SSH args
- Update tpm2.nix to use the patched agent and new pinentry