feat(waybar,sway): htop click handler, app keybinds, VPN toggle

waybar:
- cpu / custom/memory: on-click opens floating ghostty with htop
- new custom/vpn module between custom/memory and network#bond:
  shows 'VPN' coloured by interface UP flag (green up, dim down);
  on-click toggles networkctl up/down hodor; SIGRTMIN+8 used for
  instant refresh after toggle

sway:
- Super+Shift+Return -> ghostty -e yazi
- Super+Shift+b -> librewolf

vpn-toggle.sh runs networkctl (no sudo) thanks to a new polkit rule
allowing wheel-group members to invoke org.freedesktop.network1.*
without a password prompt. systemd-networkd's polkit gate is a
separate path from sudoers, so this is the idiomatic fix.

KEYBINDS.md updated for both new sway bindings.

4 files changed, 52 insertions, 0 deletions

diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc
index 2270b42..95aa17e 100644
--- a/dot_config/waybar/config.jsonc
+++ b/dot_config/waybar/config.jsonc
@@ -9,6 +9,7 @@
     "cpu",
     "temperature",
     "custom/memory",
+    "custom/vpn",
     "network#bond",
     "custom/dock",
     "battery",
@@ -46,6 +47,7 @@
     },
     "interval": 5,
     "tooltip": false,
+    "on-click": "ghostty --class=floating -e htop",
   },
 
   "custom/memory": {
@@ -53,6 +55,7 @@
     "return-type": "json",
     "interval": 10,
     "tooltip": false,
+    "on-click": "ghostty --class=floating -e htop",
   },
 
   "disk": {
@@ -103,6 +106,14 @@
     "tooltip-format": "{ifname}: {ipaddr}/{cidr}",
   },
 
+  "custom/vpn": {
+    "exec": "~/.config/waybar/vpn-status.sh",
+    "return-type": "json",
+    "interval": 5,
+    "signal": 8,
+    "on-click": "~/.config/waybar/vpn-toggle.sh",
+  },
+
   "battery": {
     "format": "{icon} {capacity}%",
     "format-charging": "󰂄 {capacity}%",
diff --git a/dot_config/waybar/executable_vpn-status.sh b/dot_config/waybar/executable_vpn-status.sh
new file mode 100644
index 0000000..37fea84
--- /dev/null
+++ b/dot_config/waybar/executable_vpn-status.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Waybar custom/vpn module: report whether the wireguard interface
+# (managed by systemd-networkd) is admin-up. Output is a single line of
+# JSON so waybar can style it via the .up / .down classes.
+
+iface=hodor
+
+if ip link show "$iface" 2>/dev/null | grep -qE '<[^>]*\<UP\>'; then
+  printf '{"text":"VPN","class":"up","tooltip":"%s up"}\n' "$iface"
+else
+  printf '{"text":"VPN","class":"down","tooltip":"%s down"}\n' "$iface"
+fi
diff --git a/dot_config/waybar/executable_vpn-toggle.sh b/dot_config/waybar/executable_vpn-toggle.sh
new file mode 100644
index 0000000..df13a3d
--- /dev/null
+++ b/dot_config/waybar/executable_vpn-toggle.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Toggle the wireguard interface managed by systemd-networkd. Polkit
+# rule (etc/polkit-1/rules.d/50-networkd-wheel.rules) lets wheel-group
+# members invoke networkctl up/down without a password prompt.
+#
+# After the state change, send SIGRTMIN+8 to waybar so the custom/vpn
+# module refreshes immediately instead of waiting for the next interval.
+
+set -eu
+
+iface=hodor
+
+if ip link show "$iface" 2>/dev/null | grep -qE '<[^>]*\<UP\>'; then
+  networkctl down "$iface"
+else
+  networkctl up "$iface"
+fi
+
+# Refresh waybar's custom/vpn module right away.
+pid=$(pidof waybar || true)
+[ -n "$pid" ] && kill -SIGRTMIN+8 "$pid" 2>/dev/null || true
diff --git a/dot_config/waybar/style.css b/dot_config/waybar/style.css
index f0d764d..86e546a 100644
--- a/dot_config/waybar/style.css
+++ b/dot_config/waybar/style.css
@@ -28,6 +28,14 @@ window#waybar {
   background-color: #fb4934;
 }
 
+#custom-vpn.up {
+  color: #b8bb26;
+}
+
+#custom-vpn.down {
+  color: #928374;
+}
+
 #mode {
   color: #fabd2f;
   font-weight: bold;