feat(waybar,sway): htop click handler, app keybinds, VPN toggle

waybar:
- cpu / custom/memory: on-click opens floating ghostty with htop
- new custom/vpn module between custom/memory and network#bond:
  shows 'VPN' coloured by interface UP flag (green up, dim down);
  on-click toggles networkctl up/down hodor; SIGRTMIN+8 used for
  instant refresh after toggle

sway:
- Super+Shift+Return -> ghostty -e yazi
- Super+Shift+b -> librewolf

vpn-toggle.sh runs networkctl (no sudo) thanks to a new polkit rule
allowing wheel-group members to invoke org.freedesktop.network1.*
without a password prompt. systemd-networkd's polkit gate is a
separate path from sudoers, so this is the idiomatic fix.

KEYBINDS.md updated for both new sway bindings.

1 files changed, 11 insertions, 0 deletions

diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc
index 2270b42..95aa17e 100644
--- a/dot_config/waybar/config.jsonc
+++ b/dot_config/waybar/config.jsonc
@@ -9,6 +9,7 @@
     "cpu",
     "temperature",
     "custom/memory",
+    "custom/vpn",
     "network#bond",
     "custom/dock",
     "battery",
@@ -46,6 +47,7 @@
     },
     "interval": 5,
     "tooltip": false,
+    "on-click": "ghostty --class=floating -e htop",
   },
 
   "custom/memory": {
@@ -53,6 +55,7 @@
     "return-type": "json",
     "interval": 10,
     "tooltip": false,
+    "on-click": "ghostty --class=floating -e htop",
   },
 
   "disk": {
@@ -103,6 +106,14 @@
     "tooltip-format": "{ifname}: {ipaddr}/{cidr}",
   },
 
+  "custom/vpn": {
+    "exec": "~/.config/waybar/vpn-status.sh",
+    "return-type": "json",
+    "interval": 5,
+    "signal": 8,
+    "on-click": "~/.config/waybar/vpn-toggle.sh",
+  },
+
   "battery": {
     "format": "{icon} {capacity}%",
     "format-charging": "󰂄 {capacity}%",