feat: start-at-login is a Settings switch, off by default (v2.5.0)

- Settings → About → "Start AgentHub automatically" (AutostartSettings.tsx,
  GET/PUT /api/settings/autostart, server/lib/autostart.js). The switch is
  the systemd --user unit's / LaunchAgent's enabled state: on writes a unit
  for the running server when none exists and enables it, off disables it;
  neither starts or stops the server. A foreign unit is never touched
  (409 EFOREIGN)
- The plugin bootstrap no longer installs a unit on every install: it
  installs or starts one only while the user has it enabled, and a rewrite
  keeps the enabled state (writeUserService({ enable })). An install that
  already had the unit enabled stays on. A stale-but-enabled unit beside a
  live detached server is repointed, no longer started onto the bound port
- unitIsEnabled / setUnitEnabled in systemd-service.js and launchd-service.js

Also:
- fix(workspace): status bar no longer covers the chat box below md (#61)

docs/PLUGINS.md

@@ -130,8 +130,9 @@ waits on an install:
 6. **Legacy hook cleanup** — see above.
 7. **CLI** — write the `~/.local/bin/agenthub` launcher, never clobbering a `agenthub` the bootstrap did not write. It pins the node that ran the bootstrap and falls back to `node` on `PATH` when that binary is gone (a Homebrew Cellar or nvm path deleted by an upgrade).
 8. **UI build** — `client/` is copied into the runtime dir and built there (`npm ci --include=dev`, falling back to `npm install --include=dev`, then `npm run build`), landing in `runtime/client-dist` — the same directory the server serves from. `--include=dev` is required, not tidy: the entire build toolchain (`vite`, `typescript`, `@vitejs/plugin-react`, `tailwindcss`, `@types/*`) is a devDependency, and npm reads an inherited `NODE_ENV=production` as `--omit=dev`. Every bootstrap descended from the running server carries that env — the self-update chain, and any `SessionStart` fired by a `claude` inside a tmux pane the server started — so without the flag the install drops `vite` and the build dies on missing types. Skipped when a bundle for the current version already exists; a failure here does not fail the bootstrap (the API still works, and `/agenthub-open` can retry) but does mean `/run` 404s until it's fixed — and when a bundle from the PREVIOUS version is still on disk the failure is quieter still: the dashboard keeps serving the old UI against the new API, visible only as the Settings page's `UI build vX (rebuild client to match)` line.
-9. **Server** — on Linux with `systemd --user` available, install/refresh a
-   `agenthub.service` unit — on macOS with a GUI login, the
+9. **Server** — when the user has turned **Start AgentHub automatically** on
+   (Settings → About; OFF by default), install/refresh the
+   `agenthub.service` unit on Linux — on macOS with a GUI login, the
    `io.smartgift.agenthub` LaunchAgent (see [Auto-start on boot](#auto-start-on-boot)) — instead
    of a bare spawn, so the server is supervised and comes back after a reboot
    with no Claude Code session involved. Everywhere else (Windows, no
@@ -242,7 +243,16 @@ throughout: a directory that will not delete is left alone, never an error.
 
 ### Auto-start on boot
 
-On Linux, every plugin bootstrap (not just the first) installs/refreshes a
+Opt-in, and off by default: Settings → About → **Start AgentHub automatically**
+(`GET/PUT /api/settings/autostart`, `server/lib/autostart.js`). The switch IS
+the unit's enabled state — on writes a unit for the running server when none
+exists and enables it, off disables it; neither starts or stops the server. A
+bootstrap only installs or starts a unit that is enabled, never changes that
+state (`writeUserService({ enable })` keeps it on a rewrite), and with it off
+the server is the detached spawn below. An install that already had the unit
+enabled before this switch existed keeps it on.
+
+While it is on, every plugin bootstrap (not just the first) installs/refreshes a
 systemd `--user` service (`~/.config/systemd/user/agenthub.service`, managed via
 `scripts/systemd-service.js` — shared with the checkout path's
 `agenthub service install`, see the README). Its `ExecStart`/`WorkingDirectory`