feat: opt-in Windows service mode (boot-time, one elevation) + v1.0.0

The per-user Startup-folder launcher (W3) only ever runs after this user
signs in. A real Windows Service would start earlier, but under
LocalSystem/NetworkService -- accounts with no normal profile, so
%LOCALAPPDATA%\meshbay\ (config, keystore, data) would not exist for it.
Relocating storage to make that work is real surgery, deliberately not
done here.

Instead: a Scheduled Task, created once with admin rights, that runs AS
THIS USER at boot without needing them to sign in first.
`schtasks /create ... /ru <user> /rp ""` with no `/it` registers an S4U
(Service For User) logon -- no password stored anywhere, and unlike
LocalSystem it loads this account's own profile, so config_dir()/
data_dir() need zero changes. The cost: S4U carries no network credential,
which the node never needed -- everything it touches is local disk plus
outbound internet. Creating the task needs admin (a boot trigger touches
system-wide scheduler state, the same reason /sc onlogon needed it);
querying/starting/stopping an existing one does not -- Task Scheduler
grants the owning user that much itself, which is what lets the Node
page's Start/Stop/Restart drive it with no further UAC prompts.

meshbay_node/platform.py
  service_install/_remove/_status/_run/_end -- mirrors autostart_* but
  for the Scheduled Task; TASK_NAME moved here (was decorative before)

meshbay_node/daemon.py
  new `service install|remove|start|stop|status` verb; restart-daemon and
  reset now check for the service task too

packaging/win/service.ps1
  the installer-side equivalent (extraResource); status/run/end never
  self-elevate -- only install/remove do, exactly matching what
  Task Scheduler itself requires

packaging/win/service-mode.ps1
  ONE elevated helper running service.ps1 + firewall.ps1 together, so
  choosing service mode costs exactly one UAC prompt, not two

build/installer.nsh
  the install-time choice: "run as a background service?" (one
  elevation, both jobs) vs the existing per-user + separate firewall
  question. Checked first, unelevated, so re-running setup with
  everything already configured asks nothing. Uninstall offers the
  matching one-elevation cleanup, default No.

src/main.js
  winServiceTaskStatus/Run/End, wired into node:installed,
  node:service-status/-stop/-restart and node:start: when the Scheduled
  Task exists, drive it; otherwise fall back to the existing per-user
  spawn/kill path. This is the hard requirement -- Start/Stop/Restart
  from the Node page must work in either mode.

node-page.js / locales
  a hint explaining why the per-user autostart toggle is absent when
  service mode is active (info.mode from the backend, no new field to
  gate on -- it just isn't sent in that case)

package.json: 0.1.0 -> 1.0.0.

Verified: electron-builder compiles the new NSIS choice logic and ships
all three scripts; service.ps1's S4U install fails cleanly (Access
denied) when run unelevated, and its status/run/end never touch "runas".
Cannot verify the elevated success path myself (no admin in this
session) -- that needs a real UAC click. Node suite 843 pass / 25 skip;
test_packaging_win.py pins the one-elevation property, the S4U flags,
and that main.js actually checks the service task in all three handlers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 61 insertions, 31 deletions

diff --git a/packages/meshbay-client/build/installer.nsh b/packages/meshbay-client/build/installer.nsh
index d2307c8..70858c6 100644
--- a/packages/meshbay-client/build/installer.nsh
+++ b/packages/meshbay-client/build/installer.nsh
@@ -1,16 +1,28 @@
 ; electron-builder NSIS customisation (auto-included: build/installer.nsh).
 ;
-; Per-user install, no elevation (package.json build.nsis). This does three
-; things beyond the default: put the bundled daemon on the user's PATH so
-; `meshbay-node` works in a terminal; offer to add the inbound firewall rules
-; in one elevated step instead of two "Allow access" dialogs later; and clean
-; up the one piece of state that lives outside the install directory (the W3
-; "run at sign-in" launcher).
+; Per-user install, no elevation (package.json build.nsis) -- that part never
+; changes. What this adds, all conditional on interactive setup (never
+; ${Silent}):
+;   - the bundled daemon dir on the user's PATH, so `meshbay-node` works in a
+;     terminal;
+;   - a choice of autostart: the normal per-user Startup-folder launcher (no
+;     admin, starts at sign-in -- see meshbay_node.platform._startup_vbs),
+;     or a background-service mode (one admin confirmation, starts at boot,
+;     no sign-in required -- see meshbay_node.platform.service_install and
+;     packaging/win/service.ps1);
+;   - the inbound firewall rules, folded into that SAME elevation when service
+;     mode is chosen, or offered on their own otherwise -- never two UAC
+;     prompts for one install;
+;   - cleanup of whichever of those is outside $INSTDIR on the way out (the
+;     Startup .vbs; the scheduled task and firewall rules, together, if the
+;     user opts in).
 ;
 ; Deliberately NOT touched:
 ;   - %LOCALAPPDATA%\meshbay\  (node.toml, keystore.enc, unlock.key, data/) --
 ;     the keystore must survive an uninstall/reinstall; installers place files,
-;     never remove secrets.
+;     never remove secrets. This is also why service mode needs no code
+;     changes to platform.py: it runs as this same user (S4U), so it is the
+;     same profile either way.
 
 !include "WinMessages.nsh"
 !include "WordFunc.nsh"
@@ -40,27 +52,42 @@
   WriteRegExpandStr HKCU "Environment" "Path" "$1"
   SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000
 
-  ; Firewall. MeshBay.exe / meshbay-node.exe (WebRTC) and MeshBay.exe again
-  ; (LAN cast) each need an inbound allow, and Windows prompts "Allow access"
-  ; the first time each does. A per-user installer cannot pre-create a
-  ; firewall rule (that needs admin), so offer one elevated helper: one UAC
-  ; prompt instead of up to four dialogs spread across first use.
-  ;
-  ; Checked first, UNELEVATED (Get-NetFirewallRule needs no admin, only
-  ; New/Remove do) -- so re-running setup with the rules already in place
-  ; asks nothing and never pops UAC again.
-  nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check'
-  Pop $0
-  ${If} $0 != 0
-    ${IfNot} ${Silent}
+  ${IfNot} ${Silent}
+    ; Already configured -- an upgrade, or a repair install -- asks nothing.
+    ; Checked unelevated: reading firewall rules needs no admin, only
+    ; creating them does (same reasoning as the service task below). Whether
+    ; service mode or per-user mode was chosen last time, firewall rules
+    ; existing already means there is nothing left for this dialog to do.
+    nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check'
+    Pop $0
+    ${If} $0 == 0
+      Goto mb_mode_done
+    ${EndIf}
+
+    ; The choice. Service mode needs admin to CREATE (a boot trigger touches
+    ; system-wide scheduler state -- the same reason /sc onlogon needed it
+    ; too); day-to-day start/stop from the Node page does not, once the task
+    ; exists, because Task Scheduler grants the owning user that much itself.
+    MessageBox MB_YESNO|MB_ICONQUESTION \
+      "Run MeshBay Node as a background service?$\n$\nIt starts automatically at boot, even before you sign in, and needs one administrator confirmation now (which also sets up the Windows Firewall rules, in the same step).$\n$\nChoose No for the normal per-user mode instead: it starts when you sign in, no admin needed, and you will be asked about the firewall rules separately." \
+      IDNO mb_peruser_mode
+
+      ; -- Service mode: one elevation, both jobs --------------------------
+      ExecShellWait "runas" "${MB_PWSH}" \
+        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action install' \
+        SW_HIDE
+      Goto mb_mode_done
+
+    mb_peruser_mode:
+      ; -- Per-user mode: the firewall question stands on its own ----------
       MessageBox MB_YESNO|MB_ICONQUESTION \
         "Allow MeshBay through Windows Firewall now?$\n$\nMeshBay connects to other devices on your local network. Choosing Yes adds the rules in one step (Windows will ask for administrator confirmation). Choosing No is fine too -- Windows will ask you to allow access the first time MeshBay connects." \
-        /SD IDYES IDNO mb_skip_fw
+        /SD IDYES IDNO mb_mode_done
         ExecShellWait "runas" "${MB_PWSH}" \
           '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" add' \
           SW_HIDE
-      mb_skip_fw:
-    ${EndIf}
+
+    mb_mode_done:
   ${EndIf}
 !macroend
 
@@ -73,18 +100,21 @@
   WriteRegExpandStr HKCU "Environment" "Path" "$1"
   SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000
 
-  ; Offer to take the firewall rules back out (needs admin again). A stale
-  ; allow-rule pointing at a deleted exe is inert, so this is opt-in and
-  ; default-No -- a silent uninstall skips it entirely. customUnInstall runs
-  ; before the files are removed, so firewall.ps1 is still there.
+  ; Offer to take the firewall rules, and the service task if one was set up,
+  ; back out together (needs admin again -- one prompt for both, same as
+  ; install). Both underlying removes are no-ops when there is nothing to
+  ; remove, so this is safe to run unconditionally regardless of which mode
+  ; was chosen. Stale rules/tasks are inert if left, so this is opt-in and
+  ; default-No; a silent uninstall skips it entirely. customUnInstall runs
+  ; before the files are removed, so service-mode.ps1 is still there.
   ${IfNot} ${Silent}
     MessageBox MB_YESNO|MB_ICONQUESTION \
-      "Remove MeshBay's Windows Firewall rules? This needs one administrator confirmation. They are harmless if left." \
-      /SD IDNO IDNO mb_keep_fw
+      "Remove MeshBay's Windows Firewall rules and its boot-time service task, if you set one up? This needs one administrator confirmation. Both are harmless if left." \
+      /SD IDNO IDNO mb_keep_privileged
       ExecShellWait "runas" "${MB_PWSH}" \
-        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" remove' \
+        '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action remove' \
         SW_HIDE
-    mb_keep_fw:
+    mb_keep_privileged:
   ${EndIf}
 
   ; meshbay_node.platform._startup_vbs() -- if the user ran "meshbay-node