Give the VPN a toggle, an indicator, and a way back

Turning on a WireGuard profile whose server was unreachable used to cost the
whole network stack, and the only way out was nmcli typed into a terminal.
Quickshell's Networking module has no VPN surface, so this arrives as the one
sanctioned nmcli exception: a helper that lists, raises and lowers profiles,
a service that watches NetworkManager for changes made anywhere, a quick
settings tile (left-click toggles the most recently used profile, right-click
picks among them), and a bar glyph while a tunnel is up.

The safety property is in the helper, where it cannot be skipped: activation
waits a bounded 25 seconds, and a failure is rolled back down and reported
instead of leaving a black-hole default route. The contract pins exactly that,
against a stateful stub NetworkManager.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

config/dot/quickshell/modules/quicksettings/qmldir

@@ -16,5 +16,6 @@ RecentExchange 1.0 RecentExchange.qml
 RowButton 1.0 RowButton.qml
 ScrollColumn 1.0 ScrollColumn.qml
 Section 1.0 Section.qml
+VpnList 1.0 VpnList.qml
 WifiList 1.0 WifiList.qml
 PowerProfileList 1.0 PowerProfileList.qml