fix(up): don't pass OLM secret via argv to the detached subprocess

[BYBEYER]

Fixes #127

Problem

In detached mode, pangolin up re-spawns itself as an elevated subprocess and passes the OLM device credentials on the command line (--id/--secret), even when they come from the account store. The secret is visible to every local process via ps / /proc/<pid>/cmdline (world-readable) — transiently in the sudo sh -c wrapper argv, and for the entire lifetime of the detached daemon. See #127 for full details and reproduction.

Change

When the credentials come from the account store (credentialsFromKeyring), the parent no longer passes --id/--secret to the subprocess. The subprocess already resolves the invoking user's config dir via SUDO_USER and reads the account store there (it does this today for the session token), so it now reads the OLM credentials from the same place.

Details:

• isSubprocess is computed early (moved up from the detach block) so the credential-resolution path can distinguish the elevated subprocess from a direct invocation.
• The subprocess skips EnsureOlmCredentials: the parent ran it and saved the result moments earlier, so re-running it would only duplicate API calls — and in the worst case have the root subprocess write the user-owned accounts.json.
• Explicitly passed --id/--secret flags keep working exactly as before (still forwarded via argv; the user supplied them on their own command line to begin with).

Testing

• go build ./..., go vet ./..., go test ./... clean on Linux (go 1.26.5, amd64).
• Live verification on a real Pangolin deployment (detached pangolin up, checking /proc/<pid>/cmdline and that the client connects/registers) is in progress; I'll follow up with the result in a comment.

🤖 Generated with Claude Code

[BYBEYER]

Live verification done on a real deployment (Fedora Atomic/Bazzite host, Pangolin server on 1.10.x, account-store credentials, detached mode):

• The elevated daemon's argv is now clean for the whole process lifetime:

  $ tr '\0' ' ' </proc/$(pgrep -f "up client")/cmdline
  /path/to/pangolin up client --org <org> --endpoint https://<server> --prefer-local-routes
  

  No --id/--secret — before the patch both were present in /proc/<pid>/cmdline.

• The transient sudo sh -c "… nohup …" wrapper argv is likewise secret-free (only the env-var exports and the same flags as above).

• Client behavior unchanged: sudo prompt on up, daemon connects and registers (pangolin status → Connected, site reachable via relay), DNS override installed and restored cleanly on down.