feat: Windows 安装器 + 修复 daemon 无法连接问题

- 新增 Inno Setup 安装器脚本 (installer/lmvpn.iss)，支持自定义安装路径、
  桌面快捷方式、安装前杀死旧进程，打包 wintun.dll
- Makefile 新增 installer-windows 目标，支持 ISCC 和 Wine 两种编译方式
- Windows IPC 从 AF_UNIX 改为 TCP (127.0.0.1:18923)，解决提权 daemon 与
  非提权 GUI 之间的完整性级别限制导致 daemon did not become reachable
- 修复 elevation_windows.go 中 ShellExecute 参数路径含空格时被截断的问题
  (C:\Program Files\LMVPN\lmvpnd.exe → 只取到 C:\Program)
- ensureDaemon 重试次数 40→60，添加连接失败日志便于诊断
- 新增 IPCNetwork()/IPCAddress() 跨平台函数，统一 IPC 传输层抽象

internal/daemon/daemon.go

@@ -60,8 +60,8 @@ func Run(userHome string, uid, gid int) error {
 	// Chown the IPC socket so the non-root GUI process can connect.
 	// This is the critical fix: without it, the socket is owned by
 	// root:wheel with mode 0660, and the user cannot dial it.
-	chownToUser(paths.IPCSocketPath(), uid, gid)
-	log.L().Info("daemon listening", "socket", paths.IPCSocketPath())
+	chownToUser(paths.IPCAddress(), uid, gid)
+	log.L().Info("daemon listening", "socket", paths.IPCAddress())
 
 	d := &daemon{server: server}
 

internal/ipc/ipc.go

@@ -100,15 +100,26 @@ type Server struct {
 }
 
 // NewServer creates (but does not start) the IPC server. It removes
-// any stale socket file first.
+// any stale socket file first (unix only).
 func NewServer() (*Server, error) {
-	_ = os.Remove(paths.IPCSocketPath())
-	l, err := net.Listen("unix", paths.IPCSocketPath())
+	netType := paths.IPCNetwork()
+	addr := paths.IPCAddress()
+
+	// Clean up stale unix socket file (not needed for TCP).
+	if netType == "unix" {
+		_ = os.Remove(addr)
+	}
+
+	l, err := net.Listen(netType, addr)
 	if err != nil {
 		return nil, fmt.Errorf("listen ipc: %w", err)
 	}
-	// Mode 0660 so group members (admin) can connect.
-	_ = os.Chmod(paths.IPCSocketPath(), 0o660)
+
+	// Set socket permissions so group members can connect (unix only).
+	if netType == "unix" {
+		_ = os.Chmod(addr, 0o660)
+	}
+
 	return &Server{listener: l, clients: make(map[net.Conn]bool)}, nil
 }
 
@@ -178,7 +189,7 @@ type Client struct {
 
 // Dial connects to the daemon.
 func Dial() (*Client, error) {
-	conn, err := net.Dial("unix", paths.IPCSocketPath())
+	conn, err := net.Dial(paths.IPCNetwork(), paths.IPCAddress())
 	if err != nil {
 		return nil, fmt.Errorf("dial daemon: %w", err)
 	}

internal/paths/paths_darwin.go

@@ -7,9 +7,11 @@ import (
 	"path/filepath"
 )
 
-// IPCSocketPath returns the path to the unix domain socket used for
-// GUI <-> daemon communication.
-func IPCSocketPath() string { return "/tmp/lmvpn.sock" }
+// IPCNetwork returns the transport network for GUI <-> daemon IPC.
+func IPCNetwork() string { return "unix" }
+
+// IPCAddress returns the listen/dial address for GUI <-> daemon IPC.
+func IPCAddress() string { return "/tmp/lmvpn.sock" }
 
 func init() {
 	home, _ := os.UserHomeDir()

internal/paths/paths_other.go

@@ -7,9 +7,11 @@ import (
 	"path/filepath"
 )
 
-// IPCSocketPath returns the path to the unix domain socket used for
-// GUI <-> daemon communication.
-func IPCSocketPath() string { return "/tmp/lmvpn.sock" }
+// IPCNetwork returns the transport network for GUI <-> daemon IPC.
+func IPCNetwork() string { return "unix" }
+
+// IPCAddress returns the listen/dial address for GUI <-> daemon IPC.
+func IPCAddress() string { return "/tmp/lmvpn.sock" }
 
 func init() {
 	home, _ := os.UserHomeDir()

internal/paths/paths_windows.go

@@ -7,12 +7,18 @@ import (
 	"path/filepath"
 )
 
-// IPCSocketPath returns the path to the unix domain socket used for
-// GUI <-> daemon communication. On Windows 10 1803+ AF_UNIX is
-// supported; the socket is placed in the user's temp directory.
-func IPCSocketPath() string {
-	return filepath.Join(os.TempDir(), "lmvpn.sock")
-}
+// IPCNetwork returns the transport network for GUI <-> daemon IPC.
+// Windows uses TCP because AF_UNIX sockets enforce mandatory
+// integrity-level checks: a socket created by the elevated daemon
+// (High Integrity) cannot be connected to by the non-elevated GUI
+// (Medium Integrity). TCP on 127.0.0.1 has no such restriction.
+func IPCNetwork() string { return "tcp" }
+
+// IPCAddress returns the listen/dial address for GUI <-> daemon IPC.
+// On Windows this is a TCP address on localhost.
+const ipcPort = "18923"
+
+func IPCAddress() string { return "127.0.0.1:" + ipcPort }
 
 func init() {
 	home, _ := os.UserHomeDir()

internal/ui/daemon.go

@@ -74,11 +74,14 @@ func ensureDaemon() (*ipc.Client, error) {
 
 	// Wait for the daemon to become reachable.
 	logFile := paths.DaemonLogFile()
-	for i := 0; i < 40; i++ {
+	for i := 0; i < 60; i++ {
 		time.Sleep(250 * time.Millisecond)
 		if c, err := ipc.Dial(); err == nil {
-			log.L().Info("daemon connected", "socket", paths.IPCSocketPath())
+			log.L().Info("daemon connected", "socket", paths.IPCAddress())
 			return c, nil
+		} else if i == 0 || i == 10 || i == 30 || i == 59 {
+			log.L().Warn("daemon not reachable yet, retrying",
+				"attempt", i+1, "socket", paths.IPCAddress(), "error", err)
 		}
 	}
 	return nil, fmt.Errorf("daemon did not become reachable (check %s)", logFile)

internal/ui/elevation_windows.go

@@ -15,7 +15,7 @@ const daemonBinaryName = "lmvpnd.exe"
 // launchElevated launches the daemon-launch subcommand with UAC
 // elevation via ShellExecute "runas" on Windows.
 func launchElevated(exe, daemonBin, home string, uid, gid int) error {
-	args := fmt.Sprintf("daemon-launch --user-home %s --uid %d --gid %d --daemon-bin %s",
+	args := fmt.Sprintf("daemon-launch --user-home \"%s\" --uid %d --gid %d --daemon-bin \"%s\"",
 		home, uid, gid, daemonBin)
 
 	shell32 := syscall.NewLazyDLL("shell32.dll")