Add macOS login startup and complete uninstall

[pedroapfilho]

Users can opt into macOS login startup with tokenmaxx install --autostart or tokenmaxx daemon install. A complete tokenmaxx uninstall now reverses setup and removes the installed application.

• Add a per-user LaunchAgent with automatic restart and a launcher named tokenmaxx, so Login Items does not attribute the service to Bun’s certificate owner. Daemon start/stop and version-driven restarts cooperate with launchd.
• Make plain uninstall stop the manager, restore Codex/Claude/pi routing, remove startup files and the launcher app, delete tokenmaxx’s Keychain entries (including orphaned credentials and chunks), remove account/usage data, preferences, logs and isolated profiles, then remove the global CLI through its owning package manager. It never restarts the daemon.
• Record settings replaced during setup so unchanged files are restored exactly. Remove files and empty client directories created by setup; preserve subsequent user edits, native client logins, unrelated files and other packages. Source checkouts are retained. Overwritten settings from older installs without records cannot be reconstructed.
• Keep narrower controls explicit: daemon disable removes startup and stops the daemon; uninstall routing and uninstall pi only restore routing. Update help, status, doctor, recovery instructions and README accordingly.
• Keep recovery data when a cleanup step fails and remove the global package only after setup cleanup succeeds. Reject unsafe data roots, conflicting startup configurations and unrelated launcher apps.

Behavior change: plain tokenmaxx uninstall now deletes saved tokenmaxx accounts and usage data and removes the global package. Use tokenmaxx uninstall routing for the previous routing-only operation. Emergency recovery instructions now use that narrower command.

Validation:

• bun run check — typecheck, formatting/lint, and 102 passing tests.
• bun run build.
• TOKENMAXX_TEST_LAUNCHD=1 bun test src/launch-agent.test.ts — real macOS integration with a unique service label, temporary directories, an empty account database and an ephemeral port. Covers one manager process, automatic restart, stop/start, reinstall, conflict handling and full cleanup. This test is opt-in because it requires a macOS GUI login session. Credential deletion and global package removal use isolated test doubles; no live accounts or packages are removed by tests.

[DexterStorey]

Merging this — thanks Pedro. A few changes on top, so you know what landed:

• Bare tokenmaxx uninstall stays routing-only, and the complete removal moved to tokenmaxx uninstall all. uninstall is the documented escape hatch (README, the daemon-failure message, existing muscle memory), and making it delete every keychain credential with no confirmation was too sharp. uninstall routing still works as an alias.
• Config backups re-snapshot when the file changed since the last install (saveConfigBackup). Before, the first install's original was kept forever. tokenmaxx re-installs on every version bump, which folded later user edits into installed, so uninstall then wrote back the stale original and dropped them. There's a regression test for it.
• uninstall all from a custom TOKENMAXX_HOME only deletes the credentials that home's accounts reference. Keychain items aren't scoped per home, so a service-wide delete from a test or secondary home wiped the main install. The default home keeps the full sweep for orphans.
• Grok integration, since grok accounts #29 landed first: GROK_HOME passes through to the LaunchAgent, uninstall all restores grok routing, and the tests sandbox GROK_HOME.
• config-install.test.ts now sets TOKENMAXX_HOME. A few tests called applicationPaths() and wrote backup records into the real ~/.tokenmaxx.

Verified: typecheck, biome and 145 tests on Bun 1.2.20 and 1.4.2, plus TOKENMAXX_TEST_LAUNCHD=1 against real launchd (no leftovers). I also deployed it to a live install and diffed the codex and claude configs after the heal: byte-identical.