Add CampusNAS menu bar agent

Native macOS agent that keeps the office VPN and the NAS shares working
without the shell wrapper it replaces.

- VPN: full port of the `ovpn` script — host-route pinning, gateway
  discovery via networksetup, tunnel liveness by address plus pushed
  route, startup grace, restart of a wedged daemon. Root steps are
  batched into one system authorization prompt.
- SMB: mounts via NetFS, discovers shares from the server, detects
  mounts event-driven through NSWorkspace, matches the host by resolved
  alias so externally created mounts are recognised.
- Credentials never pass through the process: the VPN auth file is
  written by `security` straight to disk, and the password is stored via
  SecItemAdd rather than a command line visible in ps.
- UI: status window, settings editor, ⌘+/⌘− zoom that re-lays out rather
  than scaling a bitmap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

build.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# Builds CampusNAS.app — a menu bar agent, so it needs a real bundle:
+# UNUserNotificationCenter and SMAppService both refuse to work on a bare binary.
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+APP_NAME="CampusNAS"
+BUNDLE_ID="com.campusagro.campusnas-monitor"
+VERSION="1.0"
+APP="build/${APP_NAME}.app"
+
+# UNIVERSAL=1 builds for both architectures — needed when the .app will run on
+# a machine other than this one, which may be Intel.
+if [ "${UNIVERSAL:-0}" = "1" ]; then
+    echo "==> swift build (arm64 + x86_64)"
+    swift build -c release --arch arm64 --arch x86_64
+    BINARY=".build/apple/Products/Release/CampusNASMonitor"
+else
+    echo "==> swift build"
+    swift build -c release
+    BINARY=".build/release/CampusNASMonitor"
+fi
+
+echo "==> assembling ${APP}"
+rm -rf "$APP"
+mkdir -p "${APP}/Contents/MacOS" "${APP}/Contents/Resources"
+
+cp "$BINARY" "${APP}/Contents/MacOS/${APP_NAME}"
+
+cat > "${APP}/Contents/Info.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleName</key>
+    <string>${APP_NAME}</string>
+    <key>CFBundleDisplayName</key>
+    <string>${APP_NAME}</string>
+    <key>CFBundleIdentifier</key>
+    <string>${BUNDLE_ID}</string>
+    <key>CFBundleExecutable</key>
+    <string>${APP_NAME}</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>${VERSION}</string>
+    <key>CFBundleVersion</key>
+    <string>${VERSION}</string>
+    <key>LSMinimumSystemVersion</key>
+    <string>13.0</string>
+    <key>LSUIElement</key>
+    <true/>
+    <key>NSHumanReadableCopyright</key>
+    <string>Internal tool</string>
+</dict>
+</plist>
+PLIST
+
+plutil -lint "${APP}/Contents/Info.plist" >/dev/null
+
+echo "==> ad-hoc signing"
+codesign --force --sign - --timestamp=none "$APP"
+codesign --verify --verbose=1 "$APP"
+
+echo
+echo "Built: $(pwd)/${APP}"
+echo "Run:   open '$(pwd)/${APP}'"
+echo "Install: cp -R '$(pwd)/${APP}' /Applications/"