add strongswan vici drop-in for telegraf vpn_status

router/strongswan-vici-telegraf.conf

+# systemd drop-in for strongswan.service
+#
+# Deploy to: /etc/systemd/system/strongswan.service.d/telegraf-vici.conf
+# Then:      systemctl daemon-reload && systemctl restart strongswan
+#
+# Why: check-vpn-status.sh runs as the telegraf user and queries SA state with
+# `swanctl --list-sas`. swanctl needs the strongSwan vici socket
+# (/run/charon.vici, mode 770 root:root), which telegraf cannot read. With no
+# access, swanctl fails and the script falls back to a flappy "ipsec0 rx_bytes
+# changed in the last 10s" check -> false vpn_status connected=0 -> route-health
+# churns ikev2.* gateways dead/healthy (and flushes/re-adds 100k+ routes).
+#
+# Why not sudo: on ALT, /bin/sudo is 4710 root:wheel, so non-wheel users
+# (telegraf) cannot even execute sudo. Granting read on the vici socket directly
+# is the minimal, contained fix (no setuid binary, no wheel elevation, no
+# sudoers rule, no script change).
+#
+# strongswan.service is Type=notify, so the vici socket already exists when
+# ExecStartPost runs. `|| true` so a transient ACL failure can never take the
+# IPsec tunnel down (tunnel uptime matters more than the monitoring ACL).
+[Service]
+ExecStartPost=/bin/sh -c "setfacl -m u:telegraf:rwx /run/charon.vici || true"