replace an unreachable daemon holding the port

[DexterStorey]

Fixes #3.

A daemon left running across the 0.0.41 home rename keeps port 8459, but its IPC socket lives in the old ~/.codex-auth home. The CLI only pings the socket in the current home, so daemon status said stopped and tokenmaxx status spawned children that died three times on the port bind. Deleting manager.sock under a live daemon strands the CLI the same way.

The port is the contended resource, so the CLI now reads it directly. Every released daemon answers tokenmaxx proxy: unknown route on unknown routes; proxyIdentity(port) uses that as a fingerprint, and the 404 body is now pinned by a test as a protocol.

• daemon status reports unreachable — a tokenmaxx daemon (process N) holds port P but does not answer, exit 1, instead of lying with stopped.
• daemon start replaces an unreachable tokenmaxx occupant: SIGTERM, wait up to 5s for the port to free, SIGKILL fallback. The shutdown watchdog in daemons ≥0.0.21 makes SIGTERM sufficient; older daemons that hang draining get the SIGKILL.
• A foreign program on the port is never touched: Port P is in use by another program (process N); stop it or set TOKENMAXX_PROXY_PORT.
• doctor shows the unreachable state with the same guidance.

Verified against live daemons in isolated homes: the exact issue #3 sequence (stale cross-home daemon), the deleted-socket variant, and a foreign python3 -m http.server on the port, which errors cleanly and survives untouched.

[DexterStorey]

landed on main as 9e43ffb, one commit on top of the resets release