Replace the dotted-quad parser and the rindex HOST:PORT splitter with
Ipaddr.of_string / Ipaddr.with_port_of_string, which also accept IPv6.

eio moves to a dev commit: it adds portable Net socket options, so a
consumer can set TCP_NODELAY and friends without linking eio.unix. Every package
that depends on eio carries the pin, since opam resolves pin-depends per package
and not from the root.

The solo5 and unikraft cross-toolchains move to wip-macos+runtime_events+lto,
one branch carrying macOS cross-build support, an in-process runtime_events ring
and a flambda compiler that defaults to link-time DCE. The unikernel arms link
with -use-lto, so the compiler has to carry those patches.

These packages are published only to the opam overlay, not the public
opam-repository. Without the repo-add line a reader who runs opam install
gets nothing and has to hunt down the overlay URL by hand.

etcd_server.ml uses Grpc.Status (from nox-grpc) at runtime, but the server
library did not list nox-grpc in its dune (libraries ...) -- so Grpc was
unbound and the library did not build -- and etcd-server declared nox-grpc
only as a :with-test dependency. Add it to the library's libraries and make
it a runtime depend.

The Auth RPCs were an in-memory fake: AuthEnable flipped a flag the KV,
lease and watch handlers never checked, and Authenticate returned a token
for any password, so a client could believe the store was access-
controlled when it was not. The KV API is unauthenticated by design; make
that honest by failing AuthEnable and Authenticate with Unimplemented, so
no caller can mistake this scaffolding for a secure server.

etco serve and etco proxy bound V4.any, exposing the unauthenticated
etcd-compatible KV API (Range/Put/DeleteRange) to any network peer, and
proxy mode could re-expose a localhost-only upstream. Default the bind to
127.0.0.1 and add --listen ADDR to opt into a public address explicitly.