check-vpn-status.sh (run as the telegraf user) calls swanctl --list-sas, which
needs the root-only vici socket /run/charon.vici (770 root:root). Without
access, swanctl fails and the script falls back to a flappy rx_bytes check,
emitting false vpn_status connected=0 that churns ikev2.* gateways in
route-health.

This drop-in grants telegraf read access to the vici socket via ExecStartPost
setfacl. On ALT, /bin/sudo is 4710 root:wheel (telegraf can't even exec it), so
a sudoers approach is blocked; the vici ACL is the minimal contained fix and
needs no script or sudoers change. Type=notify guarantees the socket exists at
ExecStartPost; "|| true" so an ACL hiccup can never take the tunnel down.

Deployed to ikev2.vdska (.131), ikev2.hetzner (.120), ikev2.gr (.139),
ikev2.fr (.140).
Co-Authored-By: Claude <noreply@anthropic.com>