Let the daemon choose its own port

[sepehr-safari]

The approval API was on a fixed 127.0.0.1:8787, and the GUI concluded it was talking to its own daemon because something answered there. Anything that reached the port first would be handed the unlock passphrase, or an imported nsec, by a GUI with no way to tell the difference.

The daemon now binds port 0 in managed mode and reports what the kernel gave it. A port nobody has chosen yet cannot be taken in advance, and it differs on every start.

It reports it on stdout, and that is not incidental. The SDK's line-mode spawn ignores a child's stderr outright (.stderr = if (output_mode == .collect) .pipe else .ignore), so the ordinary std.debug.print banner would have been dropped on the floor and the GUI would have waited forever for a port it was never told. Read out of the SDK rather than assumed.

The GUI sends nothing until it has been told where to send it. Until the port line arrives it stays in starting, which is the honest state and one the retry tick already knows how to leave. A restart clears it, since a restarted daemon gets a different port. Attached mode is unchanged: the address comes from the environment and is the operator's business.

What this does not do

It does not help against a process running as this user, which can read the token file as easily as the GUI can. It closes the case where something is simply sitting on a known port, waiting.

Verified by running it

• the daemon reports a real ephemeral port and the API answers there
• the port differs across restarts (60693, then 60715)
• the GUI launched in managed mode reaches first-run setup, which it can only reach after an authenticated /info round trip to the port it was told about; its child daemon was listening on 61235, not 8787