Add TODO: run the DNS resolver as a low-privilege user

Tracks the security follow-up for network_dns.cpp's --user=root
--group=root workaround -- dnsmasq's own default privilege drop broke
reading state under /root (mode 0700), so it's kept at root entirely for
now. Not urgent (networking here is already root-only throughout), but
worth revisiting later.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

TODO.md

@@ -0,0 +1,29 @@
+# TODO
+
+## Security: run the DNS resolver (dnsmasq) as a low-privilege user
+
+`start_dns_resolver()` (`src/network_dns.cpp`) currently runs dnsmasq with
+`--user=root --group=root`, explicitly overriding dnsmasq's own default
+privilege-drop behavior. This was done because dnsmasq's default drop-to-
+unprivileged-user broke reading `$XDG_STATE_HOME` (typically
+`/root/.local/state/slocker-lite/...`, mode `0700` -- unreadable/
+untraversable by a non-root user) for its own `--hostsdir`/`--addn-hosts`
+files, causing every query to come back `REFUSED`. Keeping dnsmasq at root
+was the fastest correct fix, but it's a real, deliberately-accepted
+regression from dnsmasq's own security posture: this project's DNS resolver
+process now runs as root for its entire (per-session) lifetime, with no
+privilege drop at all, purely to work around a directory permissions
+mismatch.
+
+**Future direction**: let dnsmasq actually drop to a low-privilege user, and
+instead make the files it needs to read reachable by that user -- e.g. move
+(or additionally expose) the relevant per-network `dns-hosts/`,
+`dns-internal-hosts/`, and `dns-resolvers/` state directories somewhere a
+non-root user can traverse into (not nested under `/root`), with permissions
+scoped narrowly to just what the resolver needs. Needs some design thought
+about where that location should live consistently with this project's
+existing `$XDG_STATE_HOME` conventions, and whether the *rest* of this
+project's own state should stay root-only or move too. Not urgent -- this
+project's networking is already root-only in every other respect (bridges,
+iptables, etc.), so this is a narrower, lower-priority hardening pass for
+later, not a blocker for anything currently in progress.