fix(mac): make Start say why it failed, and copy the password without a flash - #235

… a flash

Two problems from testing the previous change.

**Start did nothing after the database was deleted.** Removing the bootstrap
password was right, but it turned a silent recreation into a silent refusal:
with the email still present and the password gone, an empty database is the
half-configured case bootstrap.go rejects outright ("CIX_BOOTSTRAP_ADMIN_EMAIL
is set but CIX_BOOTSTRAP_ADMIN_PASSWORD is empty"). The server exited in
milliseconds and the menu went back to "Stopped" — indistinguishable from a
button that does nothing. needsFirstRun already knew, but only at launch; a
running app never asked again.

Start now checks before starting, and offers to set up again rather than
spawning a process that cannot survive. It also verifies the server outlived
the start: launchctl reports having spawned it, not having kept it, so a
process that rejects its own configuration used to disappear without a word.
When that happens the server's own message is shown, trimmed to the last few
lines with a pointer to the log.

Worth stating for the record: the refusal is guarded by `count == 0`, so
retiring the password never affects a start against an intact database.

**Copy Password flashed the window.** AppleScript's `display dialog` is modal
and returns only when it closes, so a copy button meant closing the window and
opening it again — on screen, a blink. The password is now on the clipboard
before the window appears and the message says so, which removes the flash and
the click together. There is nothing to be coy about: this is a password the
app generated seconds ago and is showing on purpose.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>