Add macOS login startup and complete uninstall

[pedroapfilho]

Users can opt into macOS login startup with tokenmaxx install --autostart or tokenmaxx daemon install. A complete tokenmaxx uninstall now reverses setup and removes the installed application.

• Add a per-user LaunchAgent with automatic restart and a launcher named tokenmaxx, so Login Items does not attribute the service to Bun’s certificate owner. Daemon start/stop and version-driven restarts cooperate with launchd.
• Make plain uninstall stop the manager, restore Codex/Claude/pi routing, remove startup files and the launcher app, delete tokenmaxx’s Keychain entries (including orphaned credentials and chunks), remove account/usage data, preferences, logs and isolated profiles, then remove the global CLI through its owning package manager. It never restarts the daemon.
• Record settings replaced during setup so unchanged files are restored exactly. Remove files and empty client directories created by setup; preserve subsequent user edits, native client logins, unrelated files and other packages. Source checkouts are retained. Overwritten settings from older installs without records cannot be reconstructed.
• Keep narrower controls explicit: daemon disable removes startup and stops the daemon; uninstall routing and uninstall pi only restore routing. Update help, status, doctor, recovery instructions and README accordingly.
• Keep recovery data when a cleanup step fails and remove the global package only after setup cleanup succeeds. Reject unsafe data roots, conflicting startup configurations and unrelated launcher apps.

Behavior change: plain tokenmaxx uninstall now deletes saved tokenmaxx accounts and usage data and removes the global package. Use tokenmaxx uninstall routing for the previous routing-only operation. Emergency recovery instructions now use that narrower command.

Validation:

• bun run check — typecheck, formatting/lint, and 102 passing tests.
• bun run build.
• TOKENMAXX_TEST_LAUNCHD=1 bun test src/launch-agent.test.ts — real macOS integration with a unique service label, temporary directories, an empty account database and an ephemeral port. Covers one manager process, automatic restart, stop/start, reinstall, conflict handling and full cleanup. This test is opt-in because it requires a macOS GUI login session. Credential deletion and global package removal use isolated test doubles; no live accounts or packages are removed by tests.