feat: start-at-login is a Settings switch, off by default (v2.5.0)

- Settings → About → "Start AgentHub automatically" (AutostartSettings.tsx,
  GET/PUT /api/settings/autostart, server/lib/autostart.js). The switch is
  the systemd --user unit's / LaunchAgent's enabled state: on writes a unit
  for the running server when none exists and enables it, off disables it;
  neither starts or stops the server. A foreign unit is never touched
  (409 EFOREIGN)
- The plugin bootstrap no longer installs a unit on every install: it
  installs or starts one only while the user has it enabled, and a rewrite
  keeps the enabled state (writeUserService({ enable })). An install that
  already had the unit enabled stays on. A stale-but-enabled unit beside a
  live detached server is repointed, no longer started onto the bound port
- unitIsEnabled / setUnitEnabled in systemd-service.js and launchd-service.js

Also:
- fix(workspace): status bar no longer covers the chat box below md (#61)

scripts/plugin-bootstrap.js

@@ -8,11 +8,11 @@
  *
  * The worker installs runtime dependencies, removes hook entries left behind by
  * an older `npm run install-hooks` (they would double-count every event), puts
- * the `agenthub` CLI on PATH, and starts the dashboard server — as a systemd
- * `--user` service or a macOS LaunchAgent when available (see
- * `service-manager.js`), so it survives
- * reboots without Claude Code being opened first; otherwise a detached spawn
- * scoped to this session, same as before.
+ * the `agenthub` CLI on PATH, and starts the dashboard server — through the
+ * systemd `--user` service or macOS LaunchAgent (see `service-manager.js`)
+ * only while the user has turned start-at-login on (Settings → About, OFF by
+ * default), so it survives reboots without Claude Code being opened first;
+ * otherwise a detached spawn scoped to this session.
  *
  * Everything writable lives under `~/.claude/agenthub/runtime/` — NOT in
  * the plugin cache, which Claude Code replaces wholesale on every plugin
@@ -738,13 +738,17 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
       // the restart is deferred to `pendingSystemdRestart` below, because
       // starting it now would kill this process mid-bootstrap. Otherwise
       // there is no cgroup to be reaped by, and install-and-start is fine.
-      const result = systemdOwned
-        ? svc.writeUserService(unit)
-        : svc.systemctlAvailable()
-          ? svc.installUserService(unit)
-          : "unavailable";
+      // Start-at-login is OPT-IN (Settings → About, `/api/settings/autostart`):
+      // the unit is installed or started only while the user has it enabled,
+      // and its enabled state is never changed here.
+      const autostart = svc.unitIsEnabled("agenthub");
+      let result = "off";
+      if (systemdOwned) result = svc.writeUserService({ ...unit, enable: autostart });
+      else if (autostart)
+        result = needsServer ? svc.installUserService(unit) : svc.writeUserService(unit);
+      else if (unitStale) svc.writeUserService({ ...unit, enable: false });
       if (result === "written" || result === "unchanged") {
-        if (result === "written") svc.enableLinger();
+        if (result === "written" && autostart) svc.enableLinger();
         // Only when the RUNNING process has to change. A stale unit beside a
         // healthy server is now corrected on disk and left to take effect at
         // the next start — restarting a working dashboard to fix a file that