Modem Authenticator

Modem Authenticator is a background C++ service that unlocks FCC restrictions
on WWAN/modem modules. It is fully STRICT-confined (no --classic, no manual
AppArmor tweaks) and Snap-Store publishable.

Event-driven design (no polling, no custom AppArmor, idle = zero CPU):
- Layer 3 (startup): the daemon unlocks once on boot / when the MBIM

 device first appears.

- Layer 1 (udev): snapd loads meta/udev/modem-manager.rules; when an MBIM

 device is (re-)enumerated -- USB control node (/dev/cdc-wdm*) OR PCIe

 control node (/dev/wwan*mbim*, kernel >= 5.14) -- via physical re-plug,

 power cycle, or firmware/link reset that drops the bus link, the kernel

 triggers the unlock oneshot service, which performs the FCC unlock and

 exits. (Old-kernel mhi_bus PCIe nodes are covered by a commented rule.)

- Layer 2 (systemd events): best-effort -- the daemon subscribes to

 systemd JobRemoved (ModemManager restart) and PrepareForSleep (resume)

 to re-unlock after events that do NOT drop the USB link. On the target

 snapd (2.76) there is no systemd D-Bus interface, so this layer

 degrades gracefully; startup + udev still cover the realistic triggers.

The unlock itself is sent via mbimcli directly to the device node (covered
by the modem-manager plug). The FCC unlock key is HARDCODED in the binary
(not externalised to a config file), overridable at runtime with -k.

A CLI tool (fccunlocker) is also provided for manual operation.

TEST BUILD (2026-08-13): published to practice the Snap Store workflow.
Dell RW135/RW151 models use placeholder unlock keys in this release and
are not yet supported.