Add peer-to-peer file drop

Files move directly between peers over the overlay, with no server in the
path. The receiver listens on the WireGuard address only, so the port is
unreachable from outside the tunnel, and every offer is matched to a known
peer before anything is read.

Consent is the default: an offer carries metadata alone, and no payload
moves until the receiver accepts. Policy is per profile and device-local —
off, ask, or auto-accept, with per-sender exceptions on top.

Policy and history live in the profile's preferences, so removing a profile
takes its file drop state with it. Transfers interrupted by a restart are
settled on load; nothing survives to finish them, and left alone they would
sit in the log as permanently pending.

The Android bindings pull payload bytes through a chunk-returning stream:
gomobile copies a []byte argument into a fresh Java array and never copies
it back, so a fill-my-buffer method would hand back the right length with
no data.

client/proto/metadata.go

@@ -59,3 +59,24 @@ const (
 	// MetadataSourceMDM marks a config_changed driven by an MDM policy diff.
 	MetadataSourceMDM = "mdm"
 )
+
+// SystemEvent metadata markers for file drop transfers. The daemon publishes one
+// per transfer milestone; the UI shows a notification and refreshes its transfer
+// views. Progress is not evented — the UI polls FileDropListTransfers.
+const (
+	// MetadataKindFileDropOffer marks an incoming offer awaiting the user's decision.
+	MetadataKindFileDropOffer = "filedrop-offer"
+	// MetadataKindFileDropCompleted marks a finished transfer in either direction.
+	MetadataKindFileDropCompleted = "filedrop-completed"
+	// MetadataKindFileDropFailed marks a transfer that ended without completing.
+	MetadataKindFileDropFailed = "filedrop-failed"
+	// MetadataKindFileDropWithdrawn marks a pending offer that was cancelled by the
+	// sender or expired, so its consent prompt should be dismissed.
+	MetadataKindFileDropWithdrawn = "filedrop-withdrawn"
+
+	// MetadataFileDropTransferKey carries the transfer ID for the filedrop-* kinds.
+	MetadataFileDropTransferKey = "filedropTransferId"
+	// MetadataFileDropPeerKey carries the remote peer's public key for the
+	// filedrop-* kinds, so notification actions can set per-sender rules.
+	MetadataFileDropPeerKey = "filedropPeerKey"
+)