feat: 单实例锁与窗口恢复机制

- GUI 单实例锁: 新增 internal/instance 包,首实例监听专用端点,
  第二实例发送 focus 信号后静默退出 (Unix: gui.sock, Win: 18924)
- 守护进程弱锁修复: NewServer() 在 os.Remove 前先 net.Dial 探测,
  有活进程时拒绝启动,避免静默抢占 socket 导致孤儿进程
- macOS .app 重开恢复: 通过 class_addMethod 给 GLFWApplicationDelegate
  注册 applicationShouldHandleReopen:hasVisibleWindows: 回调,
  绕过 GLFW 直接用 Cocoa makeKeyAndOrderFront: 显示窗口
- 三平台覆盖: macOS/Linux 用 unix socket, Windows 用 TCP 端口

internal/paths/paths_darwin.go

@@ -13,6 +13,12 @@ func IPCNetwork() string { return "unix" }
 // IPCAddress returns the listen/dial address for GUI <-> daemon IPC.
 func IPCAddress() string { return "/tmp/lmvpn.sock" }
 
+// GUILockNetwork returns the transport for the GUI single-instance lock.
+func GUILockNetwork() string { return "unix" }
+
+// GUILockAddress returns the address for the GUI single-instance lock.
+func GUILockAddress() string { return Paths.Data + "/gui.sock" }
+
 func init() {
 	home, _ := os.UserHomeDir()
 	recomputePaths(home)

internal/paths/paths_other.go

@@ -13,6 +13,12 @@ func IPCNetwork() string { return "unix" }
 // IPCAddress returns the listen/dial address for GUI <-> daemon IPC.
 func IPCAddress() string { return "/tmp/lmvpn.sock" }
 
+// GUILockNetwork returns the transport for the GUI single-instance lock.
+func GUILockNetwork() string { return "unix" }
+
+// GUILockAddress returns the address for the GUI single-instance lock.
+func GUILockAddress() string { return Paths.Data + "/gui.sock" }
+
 func init() {
 	home, _ := os.UserHomeDir()
 	recomputePaths(home)

internal/paths/paths_windows.go

@@ -20,6 +20,13 @@ const ipcPort = "18923"
 
 func IPCAddress() string { return "127.0.0.1:" + ipcPort }
 
+// GUILockNetwork returns the transport for the GUI single-instance lock.
+// Windows uses TCP (same reason as IPC: AF_UNIX integrity-level checks).
+func GUILockNetwork() string { return "tcp" }
+
+// GUILockAddress returns the address for the GUI single-instance lock.
+func GUILockAddress() string { return "127.0.0.1:18924" }
+
 func init() {
 	home, _ := os.UserHomeDir()
 	recomputePaths(home)