feat: start-at-login is a Settings switch, off by default (v2.5.0)

- Settings → About → "Start AgentHub automatically" (AutostartSettings.tsx,
  GET/PUT /api/settings/autostart, server/lib/autostart.js). The switch is
  the systemd --user unit's / LaunchAgent's enabled state: on writes a unit
  for the running server when none exists and enables it, off disables it;
  neither starts or stops the server. A foreign unit is never touched
  (409 EFOREIGN)
- The plugin bootstrap no longer installs a unit on every install: it
  installs or starts one only while the user has it enabled, and a rewrite
  keeps the enabled state (writeUserService({ enable })). An install that
  already had the unit enabled stays on. A stale-but-enabled unit beside a
  live detached server is repointed, no longer started onto the bound port
- unitIsEnabled / setUnitEnabled in systemd-service.js and launchd-service.js

Also:
- fix(workspace): status bar no longer covers the chat box below md (#61)

scripts/systemd-service.js

@@ -103,6 +103,22 @@ function unitRoot(name) {
   return match ? match[1].trim() : null;
 }
 
+/** Is our unit enabled to start at boot/login — the Settings "start
+ *  automatically" switch. Costs a `systemctl` call. */
+function unitIsEnabled(name) {
+  if (!systemctlAvailable() || !unitIsOurs(name)) return false;
+  const res = execImpl(["is-enabled", `${name}.service`], { encoding: "utf8", stdio: "pipe" });
+  return String(res.stdout || "").trim() === "enabled";
+}
+
+/** Enable or disable our unit for boot — never starts or stops it, so the
+ *  server answering the switch stays up either way. */
+function setUnitEnabled(name, on) {
+  if (!systemctlAvailable()) return "unavailable";
+  if (!unitIsOurs(name)) return "foreign";
+  return systemctl([on ? "enable" : "disable", `${name}.service`]).status === 0 ? "ok" : "failed";
+}
+
 /** Is the unit currently running? Costs a `systemctl` call — never call it
  *  from the fast path. */
 function unitIsActive(name) {
@@ -138,14 +154,15 @@ function systemctl(args) {
 }
 
 /**
- * Writes (or refreshes) the unit file and enables it for boot — but starts
+ * Writes (or refreshes) the unit file and enables it for boot (unless
+ * `enable: false`, which leaves the enabled state as it is) — but starts
  * nothing. Split out of `installUserService` for the plugin self-update, which
  * must be able to point the unit at the new cache directory *before* anything
  * stops the running server, and defer the restart to its very last act.
  *
  * @returns {"written"|"unchanged"|"foreign"|"unavailable"|"failed"}
  */
-function writeUserService({ name, description, workingDir, execStart, env = {} }) {
+function writeUserService({ name, description, workingDir, execStart, env = {}, enable = true }) {
   if (!systemctlAvailable()) return "unavailable";
   const body = unitContent({ description, workingDir, execStart, env });
   const target = unitPath(name);
@@ -158,7 +175,7 @@ function writeUserService({ name, description, workingDir, execStart, env = {} }
     fs.mkdirSync(unitDir(), { recursive: true });
     fs.writeFileSync(target, body, "utf8");
     systemctl(["daemon-reload"]);
-    systemctl(["enable", `${name}.service`]);
+    if (enable) systemctl(["enable", `${name}.service`]);
     return "written";
   } catch {
     return "failed";
@@ -231,6 +248,8 @@ module.exports = {
   unitIsStale,
   unitRoot,
   unitIsActive,
+  unitIsEnabled,
+  setUnitEnabled,
   writeUserService,
   restartUserService,
   installUserService,