修复 daemon 启动问题，分离 GUI 和 daemon 二进制

- 分离二进制: cmd/lmvpn (GUI+Fyne) 和 cmd/lmvpnd (daemon, 无 Fyne)
  消除 daemon 启动时的 Fyne locale 初始化错误
- 新增 daemon-launch 子命令: 用 syscall.SysProcAttr{Setsid: true}
  替代 nohup, 解决 osascript 无 TTY 时的 'Inappropriate ioctl' 错误
- daemon 日志写到用户家目录: paths.SetUserHome() 覆盖 root 默认路径
- IPC socket chown 给用户: 解决 root:wheel 0660 导致 GUI 无法连接
- 修复 JWT→密码认证回退: 捕获 ServerError{auth_err} 而非仅 AuthError
- 修复 token URL 编码: 用 url.QueryEscape 替代裸拼接
- 日志去重: LMVPN_DAEMON=1 时 daemon 不再 stderr 镜像到文件
- Makefile 构建双二进制并打包到 .app bundle

cmd/lmvpn/main.go

@@ -0,0 +1,47 @@
+// Command lmvpn is the LMVPN GUI client application.
+//
+// It runs in two modes:
+//
+//	lmvpn              — GUI mode (default): Fyne desktop application
+//	lmvpn daemon-launch — launcher: forks the privileged daemon (lmvpnd)
+//	                     into a new session (Setsid) and exits immediately.
+//	                     Invoked by osascript as root; replaces fragile
+//	                     `nohup ... &` shell tricks that fail without a TTY.
+//
+// The privileged daemon itself is a separate binary, lmvpnd, to avoid
+// loading Fyne (and its locale/font initialisation) in the root process.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"lmvpn/internal/daemon"
+	"lmvpn/internal/ui"
+)
+
+func main() {
+	if len(os.Args) > 1 && os.Args[1] == "daemon-launch" {
+		runDaemonLaunch()
+		return
+	}
+
+	ui.Run()
+}
+
+// runDaemonLaunch forks the daemon binary (lmvpnd) into a new session
+// and exits immediately. Invoked by osascript (as root).
+func runDaemonLaunch() {
+	fs := flag.NewFlagSet("daemon-launch", flag.ExitOnError)
+	userHome := fs.String("user-home", "", "invoking user's home directory")
+	uid := fs.Int("uid", -1, "invoking user's UID for socket/log ownership")
+	gid := fs.Int("gid", -1, "invoking user's GID for socket/log ownership")
+	daemonBin := fs.String("daemon-bin", "", "path to the lmvpnd binary (auto-detected if empty)")
+	fs.Parse(os.Args[2:])
+
+	if err := daemon.Launch(*userHome, *uid, *gid, *daemonBin); err != nil {
+		fmt.Fprintf(os.Stderr, "daemon-launch: %v\n", err)
+		os.Exit(1)
+	}
+}

cmd/lmvpnd/main.go

@@ -0,0 +1,34 @@
+// Command lmvpnd is the privileged LMVPN daemon. It owns the WebSocket
+// transport, TUN device, and routing. It receives commands from the GUI
+// over an IPC unix socket and broadcasts state/stats events back.
+//
+// This is a separate binary from the GUI (lmvpn) to avoid loading Fyne
+// (and its locale/font initialisation) in the root process.
+//
+// Daemon flags:
+//
+//	--user-home <path>  invoking user's home dir (for log/data paths)
+//	--uid <int>         invoking user's UID (chown IPC socket + logs)
+//	--gid <int>         invoking user's GID
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"lmvpn/internal/daemon"
+)
+
+func main() {
+	fs := flag.NewFlagSet("lmvpnd", flag.ExitOnError)
+	userHome := fs.String("user-home", "", "invoking user's home directory")
+	uid := fs.Int("uid", -1, "invoking user's UID for socket/log ownership")
+	gid := fs.Int("gid", -1, "invoking user's GID for socket/log ownership")
+	fs.Parse(os.Args[1:])
+
+	if err := daemon.Run(*userHome, *uid, *gid); err != nil {
+		fmt.Fprintf(os.Stderr, "lmvpnd: %v\n", err)
+		os.Exit(1)
+	}
+}