修复 daemon 启动问题，分离 GUI 和 daemon 二进制

- 分离二进制: cmd/lmvpn (GUI+Fyne) 和 cmd/lmvpnd (daemon, 无 Fyne)
  消除 daemon 启动时的 Fyne locale 初始化错误
- 新增 daemon-launch 子命令: 用 syscall.SysProcAttr{Setsid: true}
  替代 nohup, 解决 osascript 无 TTY 时的 'Inappropriate ioctl' 错误
- daemon 日志写到用户家目录: paths.SetUserHome() 覆盖 root 默认路径
- IPC socket chown 给用户: 解决 root:wheel 0660 导致 GUI 无法连接
- 修复 JWT→密码认证回退: 捕获 ServerError{auth_err} 而非仅 AuthError
- 修复 token URL 编码: 用 url.QueryEscape 替代裸拼接
- 日志去重: LMVPN_DAEMON=1 时 daemon 不再 stderr 镜像到文件
- Makefile 构建双二进制并打包到 .app bundle

internal/paths/paths.go

@@ -26,6 +26,15 @@ type Dirs struct {
 // Paths is the resolved directory set for the current platform.
 var Paths Dirs
 
+// SetUserHome overrides the home directory used to compute Paths.
+// This is used by the daemon (which runs as root) to write logs and
+// data to the invoking user's Library folders instead of /var/root.
+func SetUserHome(home string) {
+	if home != "" {
+		recomputePaths(home)
+	}
+}
+
 // EnsureDirs creates the application directories if they do not exist.
 func EnsureDirs() error {
 	for _, d := range []string{Paths.Data, Paths.Cache, Paths.Log} {

internal/paths/paths_darwin.go

@@ -9,6 +9,16 @@ import (
 
 func init() {
 	home, _ := os.UserHomeDir()
+	recomputePaths(home)
+}
+
+// recomputePaths sets Paths based on the given home directory.
+// On macOS the layout is:
+//
+//	<home>/Library/Application Support/<BundleID>/  data
+//	<home>/Library/Caches/<BundleID>/               cache
+//	<home>/Library/Logs/<BundleID>/                 logs
+func recomputePaths(home string) {
 	lib := filepath.Join(home, "Library")
 	Paths = Dirs{
 		Data:  filepath.Join(lib, "Application Support", BundleID),

internal/paths/paths_other.go

@@ -9,6 +9,12 @@ import (
 
 func init() {
 	home, _ := os.UserHomeDir()
+	recomputePaths(home)
+}
+
+// recomputePaths sets Paths based on the given home directory.
+// Uses XDG-style layout on Linux/other platforms.
+func recomputePaths(home string) {
 	Paths = Dirs{
 		Data:  filepath.Join(home, ".local", "share", BundleID),
 		Cache: filepath.Join(home, ".cache", BundleID),