修复 daemon 启动问题，分离 GUI 和 daemon 二进制

- 分离二进制: cmd/lmvpn (GUI+Fyne) 和 cmd/lmvpnd (daemon, 无 Fyne)
  消除 daemon 启动时的 Fyne locale 初始化错误
- 新增 daemon-launch 子命令: 用 syscall.SysProcAttr{Setsid: true}
  替代 nohup, 解决 osascript 无 TTY 时的 'Inappropriate ioctl' 错误
- daemon 日志写到用户家目录: paths.SetUserHome() 覆盖 root 默认路径
- IPC socket chown 给用户: 解决 root:wheel 0660 导致 GUI 无法连接
- 修复 JWT→密码认证回退: 捕获 ServerError{auth_err} 而非仅 AuthError
- 修复 token URL 编码: 用 url.QueryEscape 替代裸拼接
- 日志去重: LMVPN_DAEMON=1 时 daemon 不再 stderr 镜像到文件
- Makefile 构建双二进制并打包到 .app bundle

internal/log/log.go

@@ -1,6 +1,11 @@
 // Package log configures structured logging (slog) to a rotating file
 // with a console mirror. Separate log files are used for the GUI and
 // the privileged daemon.
+//
+// When the daemon is launched via daemon-launch, its stderr is already
+// redirected to the log file. To avoid duplicate log lines, the daemon
+// detects the LMVPN_DAEMON=1 env var and writes only to the file (not
+// stderr). The GUI always mirrors to stderr for console visibility.
 package log
 
 import (
@@ -23,7 +28,9 @@ const (
 var logger *slog.Logger
 
 // Init configures the package-level logger writing to the given file
-// path (rotated by size) and to stderr.
+// path (rotated by size). For the GUI it also mirrors to stderr; for
+// the forked daemon it writes only to the file (since stderr is
+// already redirected to the file by the launcher).
 func Init(role Role, logFile string) *slog.Logger {
 	if err := os.MkdirAll(filepath.Dir(logFile), 0o755); err != nil {
 		// Fall back to stderr-only on failure.
@@ -37,8 +44,19 @@ func Init(role Role, logFile string) *slog.Logger {
 		MaxAge:     30, // days
 		LocalTime:  true,
 	}
-	mw := io.MultiWriter(os.Stderr, w)
-	logger = slog.New(slog.NewTextHandler(mw, &slog.HandlerOptions{
+
+	// Determine the output writer. When the daemon was forked by
+	// daemon-launch, LMVPN_DAEMON=1 is set and stderr is already
+	// pointed at the log file — so write to the file only to avoid
+	// doubling every line.
+	var out io.Writer
+	if role == RoleDaemon && os.Getenv("LMVPN_DAEMON") == "1" {
+		out = w
+	} else {
+		out = io.MultiWriter(os.Stderr, w)
+	}
+
+	logger = slog.New(slog.NewTextHandler(out, &slog.HandlerOptions{
 		Level: slog.LevelInfo,
 	}))
 	slog.SetDefault(logger)