feat: 支持 Windows x86_64 平台编译

- 新增 WinTun TUN 设备实现(tun_windows.go),无需安装驱动,
  wintun.dll 嵌入 exe 运行时自动释放
- 新增 Windows 路由管理(route_windows.go),使用 route/netsh 命令
- 新增 Windows 路径(paths_windows.go),使用 %APPDATA%/%LOCALAPPDATA%
- 拆分 daemon 启动逻辑:launch_unix.go(Setsid) / launch_windows.go
  (CREATE_NEW_PROCESS_GROUP),公共代码提取到 launch_common.go
- 拆分提权逻辑:elevation_darwin.go(osascript) / elevation_windows.go
  (ShellExecute UAC) / elevation_other.go(pkexec)
- IPCSocketPath 按平台分散,Windows 用 %TEMP%\lmvpn.sock
- daemon 二进制名用编译时常量(daemonBinaryName),按平台选定 .exe 后缀
- Makefile 新增 build-windows 目标
- 重新标记 !darwin 文件为 !darwin && !windows

internal/ui/daemon.go

@@ -3,7 +3,6 @@ package ui
 import (
 	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"time"
 
@@ -60,7 +59,7 @@ func ensureDaemon() (*ipc.Client, error) {
 	}
 
 	// Compute the daemon binary path: same directory as the GUI binary.
-	daemonBin := filepath.Join(filepath.Dir(exe), "lmvpnd")
+	daemonBin := filepath.Join(filepath.Dir(exe), daemonBinaryName)
 	if _, err := os.Stat(daemonBin); err != nil {
 		return nil, fmt.Errorf("daemon binary not found at %s: %w", daemonBin, err)
 	}
@@ -69,20 +68,9 @@ func ensureDaemon() (*ipc.Client, error) {
 	uid := os.Getuid()
 	gid := os.Getgid()
 
-	// Launch the daemon via osascript (prompts for admin password).
-	// The `daemon-launch` subcommand forks lmvpnd with Setsid and exits
-	// immediately, so osascript returns right away.
-	script := fmt.Sprintf(
-		`do shell script %q with administrator privileges`,
-		fmt.Sprintf("%s daemon-launch --user-home %s --uid %d --gid %d --daemon-bin %s",
-			shellQuote(exe), shellQuote(home), uid, gid, shellQuote(daemonBin)),
-	)
-	cmd := exec.Command("osascript", "-e", script)
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return nil, fmt.Errorf("launch daemon: %w (output: %s)", err, string(out))
+	if err := launchElevated(exe, daemonBin, home, uid, gid); err != nil {
+		return nil, err
 	}
-	log.L().Info("daemon launched via osascript",
-		"uid", uid, "gid", gid, "home", home, "daemon_bin", daemonBin)
 
 	// Wait for the daemon to become reachable.
 	logFile := paths.DaemonLogFile()
@@ -96,17 +84,4 @@ func ensureDaemon() (*ipc.Client, error) {
 	return nil, fmt.Errorf("daemon did not become reachable (check %s)", logFile)
 }
 
-// shellQuote wraps a string in single quotes for shell safety.
-// Embedded single quotes are escaped using the '\” pattern.
-func shellQuote(s string) string {
-	result := "'"
-	for _, r := range s {
-		if r == '\'' {
-			result += "'\\''"
-		} else {
-			result += string(r)
-		}
-	}
-	result += "'"
-	return result
-}
+

internal/ui/elevation_darwin.go

@@ -0,0 +1,44 @@
+//go:build darwin
+
+package ui
+
+import (
+	"fmt"
+	"os/exec"
+
+	"lmvpn/internal/log"
+)
+
+const daemonBinaryName = "lmvpnd"
+
+// launchElevated launches the daemon-launch subcommand with admin
+// privileges via osascript on macOS.
+func launchElevated(exe, daemonBin, home string, uid, gid int) error {
+	script := fmt.Sprintf(
+		`do shell script %q with administrator privileges`,
+		fmt.Sprintf("%s daemon-launch --user-home %s --uid %d --gid %d --daemon-bin %s",
+			shellQuote(exe), shellQuote(home), uid, gid, shellQuote(daemonBin)),
+	)
+	cmd := exec.Command("osascript", "-e", script)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("launch daemon: %w (output: %s)", err, string(out))
+	}
+	log.L().Info("daemon launched via osascript",
+		"uid", uid, "gid", gid, "home", home, "daemon_bin", daemonBin)
+	return nil
+}
+
+// shellQuote wraps a string in single quotes for shell safety.
+// Embedded single quotes are escaped using the '\'' pattern.
+func shellQuote(s string) string {
+	result := "'"
+	for _, r := range s {
+		if r == '\'' {
+			result += "'\\''"
+		} else {
+			result += string(r)
+		}
+	}
+	result += "'"
+	return result
+}

internal/ui/elevation_other.go

@@ -0,0 +1,28 @@
+//go:build !darwin && !windows
+
+package ui
+
+import (
+	"fmt"
+	"os/exec"
+
+	"lmvpn/internal/log"
+)
+
+const daemonBinaryName = "lmvpnd"
+
+// launchElevated launches the daemon-launch subcommand with admin
+// privileges. On Linux, pkexec is used (common on desktop Linux).
+func launchElevated(exe, daemonBin, home string, uid, gid int) error {
+	cmd := exec.Command("pkexec", exe, "daemon-launch",
+		"--user-home", home,
+		"--uid", fmt.Sprintf("%d", uid),
+		"--gid", fmt.Sprintf("%d", gid),
+		"--daemon-bin", daemonBin)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("launch daemon: %w (output: %s)", err, string(out))
+	}
+	log.L().Info("daemon launched via pkexec",
+		"uid", uid, "gid", gid, "home", home, "daemon_bin", daemonBin)
+	return nil
+}

internal/ui/elevation_windows.go

@@ -0,0 +1,44 @@
+//go:build windows
+
+package ui
+
+import (
+	"fmt"
+	"syscall"
+	"unsafe"
+
+	"lmvpn/internal/log"
+)
+
+const daemonBinaryName = "lmvpnd.exe"
+
+// launchElevated launches the daemon-launch subcommand with UAC
+// elevation via ShellExecute "runas" on Windows.
+func launchElevated(exe, daemonBin, home string, uid, gid int) error {
+	args := fmt.Sprintf("daemon-launch --user-home %s --uid %d --gid %d --daemon-bin %s",
+		home, uid, gid, daemonBin)
+
+	shell32 := syscall.NewLazyDLL("shell32.dll")
+	proc := shell32.NewProc("ShellExecuteW")
+
+	verb, _ := syscall.UTF16PtrFromString("runas")
+	file, _ := syscall.UTF16PtrFromString(exe)
+	params, _ := syscall.UTF16PtrFromString(args)
+	dir, _ := syscall.UTF16PtrFromString("")
+
+	ret, _, err := proc.Call(
+		0,
+		uintptr(unsafe.Pointer(verb)),
+		uintptr(unsafe.Pointer(file)),
+		uintptr(unsafe.Pointer(params)),
+		uintptr(unsafe.Pointer(dir)),
+		1, // SW_SHOWNORMAL
+	)
+
+	if ret <= 32 {
+		return fmt.Errorf("UAC elevation failed (code %d): %w", ret, err)
+	}
+	log.L().Info("daemon launched via UAC",
+		"uid", uid, "gid", gid, "home", home, "daemon_bin", daemonBin)
+	return nil
+}