feat(waybar,sway): htop click handler, app keybinds, VPN toggle

waybar:
- cpu / custom/memory: on-click opens floating ghostty with htop
- new custom/vpn module between custom/memory and network#bond:
  shows 'VPN' coloured by interface UP flag (green up, dim down);
  on-click toggles networkctl up/down hodor; SIGRTMIN+8 used for
  instant refresh after toggle

sway:
- Super+Shift+Return -> ghostty -e yazi
- Super+Shift+b -> librewolf

vpn-toggle.sh runs networkctl (no sudo) thanks to a new polkit rule
allowing wheel-group members to invoke org.freedesktop.network1.*
without a password prompt. systemd-networkd's polkit gate is a
separate path from sudoers, so this is the idiomatic fix.

KEYBINDS.md updated for both new sway bindings.

1 files changed, 21 insertions, 0 deletions

diff --git a/dot_config/waybar/executable_vpn-toggle.sh b/dot_config/waybar/executable_vpn-toggle.sh
new file mode 100644
index 0000000..df13a3d
--- /dev/null
+++ b/dot_config/waybar/executable_vpn-toggle.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Toggle the wireguard interface managed by systemd-networkd. Polkit
+# rule (etc/polkit-1/rules.d/50-networkd-wheel.rules) lets wheel-group
+# members invoke networkctl up/down without a password prompt.
+#
+# After the state change, send SIGRTMIN+8 to waybar so the custom/vpn
+# module refreshes immediately instead of waiting for the next interval.
+
+set -eu
+
+iface=hodor
+
+if ip link show "$iface" 2>/dev/null | grep -qE '<[^>]*\<UP\>'; then
+  networkctl down "$iface"
+else
+  networkctl up "$iface"
+fi
+
+# Refresh waybar's custom/vpn module right away.
+pid=$(pidof waybar || true)
+[ -n "$pid" ] && kill -SIGRTMIN+8 "$pid" 2>/dev/null || true