fix(vm): track smb-throttle with the other services

vm-status, backup-health and the app now show and check the SMB shaper; it
was installed by the template but missing from VMLayout.services. Checked
against the live machine after its restart (all five active).

The live machine also got the template's portForwards ignore rule: before
it, limactl published rclone's rc (127.0.0.1:5572, no auth) on the Mac's
localhost; after a restart the port is closed on the Mac and still answers
inside the machine.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AU1MhxJW1e9oTB2XvjX8WT

Author: mbeczynski

mac-app/Sources/CloudMachineCore/VMLayout.swift

@@ -39,7 +39,7 @@ public enum VMLayout {
   }
 
   /// The systemd units the share depends on, in start order.
-  public static let services = ["rclone-tm", "punchfs", "tm-bands-bind", "smbd"]
+  public static let services = ["smb-throttle", "rclone-tm", "punchfs", "tm-bands-bind", "smbd"]
 
   /// Host-side state: `~/.cloudmachine/vm`.
   public static var hostDir: URL {

mac-app/Tests/CloudMachineAppTests/AppStatusFixtures.swift

@@ -10,7 +10,9 @@ extension MachineStatus {
     machine.state = .running
     machine.address = "192.168.64.10"
     machine.services = [
-      "rclone-tm": "active", "punchfs": "active", "tm-bands-bind": "active", "smbd": "active",
+      "smb-throttle": "active", "rclone-tm": "active", "punchfs": "active",
+      "tm-bands-bind": "active",
+      "smbd": "active",
     ]
     machine.reading = VMLayout.Reading(
       buffer: VMLayout.BufferStats(

mac-app/Tests/CloudMachineAppTests/VMLayoutTests.swift

@@ -120,7 +120,9 @@ final class VMLayoutTests: XCTestCase {
   /// never failed; a unit nobody reported is unknown, not fine.
   func testServicesVerdict() {
     var services = [
-      "rclone-tm": "active", "punchfs": "active", "tm-bands-bind": "inactive", "smbd": "active",
+      "smb-throttle": "active", "rclone-tm": "active", "punchfs": "active",
+      "tm-bands-bind": "inactive",
+      "smbd": "active",
     ]
     XCTAssertEqual(VMStatus.servicesHealthy(services), true)
     services["tm-bands-bind"] = "failed"