Add flit watch: one-way folder sync to a trusted peer

Watches local directories and auto-pushes new/changed files to a
known daemon peer via fsnotify, with startup reconciliation, a
stable_after debounce, and per-file JSON state so failed sends retry
on the next connection. Multiple watch entries targeting the same
peer share a single connection/room (watchPeerGroup), resolving the
room-name-collision question flagged in PROPOSAL-watch.md. Push-only,
never propagates deletes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cli/watch.toml.example

@@ -0,0 +1,27 @@
+# flit watch config — copy to ~/.flit/watch.toml and fill in.
+#
+# Run with: flit watch
+# Sanity-check what would be sent, without connecting to anything:
+#   flit watch --dry-run
+#
+# One-way sync only: new/changed files in `dir` are pushed to `peer_id`.
+# Deletes are never propagated. The receiving device just needs to be
+# running `flit daemon` with this device listed as a trusted peer.
+
+# Required — WebSocket URL of your waste-go anchor
+signal_url = "wss://your-anchor.example.com/ws"
+
+# Optional — TURN relay for cross-network transfers
+turn_url    = "turn:your-anchor.example.com:3478"
+turn_secret = ""   # coturn use-auth-secret; leave empty to use STUN only
+
+# One [[watch]] block per watched directory. Multiple entries may target
+# different peers, or the same peer — entries sharing a peer_id share one
+# connection.
+
+[[watch]]
+dir        = "~/backups/documents"
+peer_id    = "aabbccddeeff..."   # hex Ed25519 pubkey of the destination device
+peer_label = "home-server"
+pattern    = "*.pdf,*.docx"      # comma-separated glob include-list; default "*" if omitted
+stable_after = "10s"             # quiet period after the last write before a file is considered ready