feat: start lerd from the dashboard and the macOS app

[geodro]

Opening the dashboard on a stopped lerd left you looking at a page you could not act on, so the only way back was a terminal. The core services banner now carries a Start Lerd button that runs the same start the CLI does, and the start streams its progress back, so the button counts units as they come up and names the stage it is in rather than hanging on a request that takes the better part of a minute.

A start driven from the dashboard used to take lerd-ui down with it. Starting a unit boots it out of launchd first, which is the same SIGTERM a stop is, so asking for lerd-ui killed the process running the start half way through and left the dashboard behind a 502 from nginx. The start sequence now takes a skip list, the way stop and quit already did, and the dashboard passes its own unit.

On macOS, lerd install writes a Lerd app to ~/Applications, so the environment shows up in Launchpad and Finder alongside everything else. Clicking it starts lerd when it is down and opens the dashboard when it is up. Because a cold start takes a while, the app draws a splash with the lerd mark, the unit currently coming up and a progress bar reading the same stream the dashboard does, and it waits for the start to report itself finished rather than for nginx to answer, since the vhost is up well before the databases behind it. It is built at install time with the osacompile that ships with macOS, and lerd uninstall removes it.

The paths that lead to the dashboard now agree on what to do when nothing is serving it. lerd dashboard and the tray's Open Dashboard start lerd first, the offline page offers a Start button whenever the daemon still answers on its own port, and its retry probe asks nginx for the dashboard page instead of an API route that the vhost does not proxy on every platform, which is why it used to say still offline forever after lerd came back.

127.0.0.1:7073 is treated as a fallback rather than a second home for the dashboard. A loopback session there moves onto lerd.localhost as soon as nginx answers, and while it waits it neither asks for notification permission nor registers a push subscription, because both are per origin and settling on the port would leave two browsers subscribed and every notification arriving twice.

Autostart gains an opt in for the one path that cannot shell out: with it on, opening the dashboard in a browser on a stopped lerd starts it, once per page load.

Closes #1529
Closes #1536