feat: add startup launch support (#1421)

Add launch-at-startup support across the Electron desktop app and the web CLI.

Electron now supports macOS launch-at-login through the native login item API. Login launches start OpenChamber in the background without opening a window, while Dock activation, deep links, and second-instance launches still open or focus the normal app window. The desktop Settings UI now exposes a localized launch-at-login toggle in Desktop Network Access.

The web CLI now includes `openchamber startup status|enable|disable`, backed by native user services:
- macOS: launchd LaunchAgent
- Linux: systemd --user service
- Windows: Task Scheduler

Startup services run `openchamber serve --foreground` so the OS service manager owns process lifetime and restarts. Foreground service updates now defer restarts to the service manager instead of spawning duplicate CLI restarts.

Startup services snapshot useful environment variables by default so provider tokens, PATH, SSH agent settings, and OpenCode configuration survive login/reboot starts. The snapshot avoids shell/session-only state, uses systemd-compatible env quoting on Linux, and avoids unused env artifacts on macOS.

Also adds localized docs for startup services and environment variables.

README.md

@@ -105,6 +105,10 @@ openchamber --ui-password be-creative-here
 ```bash
 openchamber --port 8080              # Custom port
 openchamber --ui-password secret     # Password-protect UI
+openchamber startup enable           # Start at login as a native service
+OPENCHAMBER_UI_PASSWORD=secret openchamber startup enable # Save service password env
+openchamber startup status           # Show startup service status
+openchamber startup disable          # Remove startup service
 openchamber tunnel help              # Tunnel lifecycle commands
 openchamber tunnel providers         # Show provider capabilities
 openchamber tunnel profile add --provider cloudflare --mode managed-remote --name prod-main --hostname app.example.com --token <token>
@@ -120,6 +124,8 @@ openchamber stop                     # Stop server
 openchamber update                   # Update to latest
 ```
 
+`startup enable` snapshots your current environment into the native service so startup behaves like you launched `openchamber` from the same shell. This preserves provider tokens, PATH, SSH agent settings, and other CLI auth/config env vars. Use `--no-env-snapshot` if you want a minimal service env.
+
 Connect to an existing OpenCode server:
 ```bash
 OPENCODE_PORT=4096 OPENCODE_SKIP_START=true openchamber