修复 daemon 启动问题，分离 GUI 和 daemon 二进制

- 分离二进制: cmd/lmvpn (GUI+Fyne) 和 cmd/lmvpnd (daemon, 无 Fyne)
  消除 daemon 启动时的 Fyne locale 初始化错误
- 新增 daemon-launch 子命令: 用 syscall.SysProcAttr{Setsid: true}
  替代 nohup, 解决 osascript 无 TTY 时的 'Inappropriate ioctl' 错误
- daemon 日志写到用户家目录: paths.SetUserHome() 覆盖 root 默认路径
- IPC socket chown 给用户: 解决 root:wheel 0660 导致 GUI 无法连接
- 修复 JWT→密码认证回退: 捕获 ServerError{auth_err} 而非仅 AuthError
- 修复 token URL 编码: 用 url.QueryEscape 替代裸拼接
- 日志去重: LMVPN_DAEMON=1 时 daemon 不再 stderr 镜像到文件
- Makefile 构建双二进制并打包到 .app bundle

internal/ui/daemon.go

@@ -1,12 +1,10 @@
-// Package ui contains the Fyne desktop GUI. It runs as the user,
-// manages profiles and credentials (SQLite + Keychain), and controls
-// the privileged daemon over IPC.
 package ui
 
 import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"time"
 
 	"lmvpn/internal/ipc"
@@ -17,6 +15,15 @@ import (
 // ensureDaemon checks if the daemon is running and launches it (as
 // root via osascript) if not. It blocks until the daemon is reachable
 // or times out.
+//
+// The daemon is launched via the `daemon-launch` subcommand of the GUI
+// binary, which uses Go's syscall.SysProcAttr{Setsid: true} to fork
+// the actual daemon binary (lmvpnd) into a new session. This is the
+// robust replacement for shell-level `nohup ... &` which fails inside
+// osascript's `do shell script` (no TTY → ioctl error).
+//
+// The --daemon-bin flag tells daemon-launch where to find lmvpnd. If
+// not given, daemon-launch auto-detects it relative to its own path.
 func ensureDaemon() (*ipc.Client, error) {
 	// Fast path: daemon already running.
 	if c, err := ipc.Dial(); err == nil {
@@ -27,24 +34,60 @@ func ensureDaemon() (*ipc.Client, error) {
 	if err != nil {
 		return nil, fmt.Errorf("resolve executable: %w", err)
 	}
+	// Resolve symlinks (e.g. .app bundle's MacOS/lmvpn).
+	exe, err = filepath.EvalSymlinks(exe)
+	if err != nil {
+		return nil, fmt.Errorf("resolve symlink: %w", err)
+	}
 
-	// Launch daemon as root via osascript administrator prompt.
+	// Compute the daemon binary path: same directory as the GUI binary.
+	daemonBin := filepath.Join(filepath.Dir(exe), "lmvpnd")
+	if _, err := os.Stat(daemonBin); err != nil {
+		return nil, fmt.Errorf("daemon binary not found at %s: %w", daemonBin, err)
+	}
+
+	home, _ := os.UserHomeDir()
+	uid := os.Getuid()
+	gid := os.Getgid()
+
+	// Launch the daemon via osascript (prompts for admin password).
+	// The `daemon-launch` subcommand forks lmvpnd with Setsid and exits
+	// immediately, so osascript returns right away.
 	script := fmt.Sprintf(
-		`do shell script "nohup %s daemon > /dev/null 2>&1 &" with administrator privileges`,
-		exe)
+		`do shell script %q with administrator privileges`,
+		fmt.Sprintf("%s daemon-launch --user-home %s --uid %d --gid %d --daemon-bin %s",
+			shellQuote(exe), shellQuote(home), uid, gid, shellQuote(daemonBin)),
+	)
 	cmd := exec.Command("osascript", "-e", script)
 	if out, err := cmd.CombinedOutput(); err != nil {
-		return nil, fmt.Errorf("launch daemon: %w (%s)", err, string(out))
+		return nil, fmt.Errorf("launch daemon: %w (output: %s)", err, string(out))
 	}
-	log.L().Info("daemon launched via osascript")
+	log.L().Info("daemon launched via osascript",
+		"uid", uid, "gid", gid, "home", home, "daemon_bin", daemonBin)
 
 	// Wait for the daemon to become reachable.
-	for i := 0; i < 20; i++ {
+	logFile := paths.DaemonLogFile()
+	for i := 0; i < 40; i++ {
 		time.Sleep(250 * time.Millisecond)
 		if c, err := ipc.Dial(); err == nil {
 			log.L().Info("daemon connected", "socket", paths.IPCSocketPath())
 			return c, nil
 		}
 	}
-	return nil, fmt.Errorf("daemon did not become reachable")
+	return nil, fmt.Errorf("daemon did not become reachable (check %s)", logFile)
+}
+
+// shellQuote wraps a string in single quotes for shell safety.
+// Embedded single quotes are escaped using the '\'' pattern.
+func shellQuote(s string) string {
+	result := "'"
+	for _, r := range s {
+		if r == '\'' {
+			result += "'\\''"
+		} else {
+			result += string(r)
+		}
+	}
+	result += "'"
+	return result
 }