VIGIL VPN client backend (Jetson)

This runtime is installed from the `VIGIL-MESH/VigilVpnClient` source checkout
on the target machine. The canonical entrypoint is:

  ./install-jetson-client-backend.sh

Default install layout:
- Runtime root: /opt/vigil/client-backend
- Service: vigil-client-backend.service
- Launcher: /opt/vigil/client-backend/start-client-backend.sh

Config:
- Active runtime config lives under /opt/vigil/client-backend/systemConfig/user/
- The installer does not copy source user configs, so a development device token
  is not silently deployed onto a Jetson.
- The same `VigilVpnAgent` process can now expose an embedded build/MCP runtime
  through the `build_agent/*` config block.
- Typical values:
  - `"enabled": true`
  - `"bind": "0.0.0.0"`
  - `"port": 9000`
  - `"mcp_path": "/mcp"`
  - `"files_dir": "build-agent-files"`

Logs:
- journalctl -u vigil-client-backend.service -n 100 --no-pager
- tail -n 100 /opt/vigil/client-backend/vigil_vpn_agent.log
