feat(packaging): one radio page for Windows autostart, firewall every mode0.13

Operator feedback on the 0.13.0 installer:

- The all-users / current-user page (electron-builder's PAGE_INSTALL_MODE)
  only ever showed "anyone who uses this computer" disabled -- MeshBay is
  per-user only (account-bound keystore/DPAPI, MESHBAY_DESIGN.md 11.2) and
  build.nsis forbids elevation. customInstallMode forces $isForceCurrentInstall
  so the page is skipped.

- The two nested Yes/No MessageBoxes are one nsDialogs radio page
  (customPageAfterChangeDir): only-while-open / at-sign-in / background service,
  default background service. customInit seeds MB_AutoMode "2" for silent
  installs where the page never runs. "At sign-in" now writes the Startup .vbs
  from the installer (meshbay-node autostart install, unelevated); the old
  per-user branch set up nothing.

- The firewall rules go in for every mode, not behind a second opt-in -- a node
  that accepts no connections is the failure mode MESHBAY_DESIGN.md 7.5 names.
  Folded into the service elevation for mode 2; their own single elevation for
  0/1. Unelevated short-circuit kept but narrower: firewall.ps1 check AND
  service.ps1 status must both pass to skip mode 2's UAC.

Var MB_AutoMode lives inside customPageAfterChangeDir, not at file scope: the
uninstaller compile pass inserts none of the macros that read it and
makensis -WX turns "unused Var" (6001) into a hard error.

Not yet exercised on a real machine -- the NSIS UI cannot be driven from the
build env. test_packaging_win.py pins the script shape.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions