feat(autostart): "Start with Windows" toggle

- PM.AutoStart wraps HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
  Value "PMServer" = "<exe>" -tray. Per-user, no admin required, shows
  up in Task Manager → Startup so the user can override from there.

- UMainForm honours the -tray CLI flag (set by the registry entry):
  after the server starts, MinimizeToTray via TThread.ForceQueue so the
  app comes up directly in the tray with no visible window flash.

- Bridge cmd://autostart/{get,set} + Bridge.getAutoStart() /
  setAutoStart() / onAutoStartStatus(). Settings exposes a toggle in
  the Security section, visible only when Bridge.active (the PHP
  frontend can't touch the registry).

- Toggle reads "on" only when the registered command matches the
  current exe path, so a stale entry from a moved exe lets the user
  re-enable to refresh.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -37,6 +37,7 @@ plus courant après modif frontend.
 | Quick unlock DPAPI (device-bound) | `delphi-backend/Source/PM.QuickUnlock.pas` |
 | Prefs key/value DPAPI (`prefs.bin`) | `delphi-backend/Source/PM.UserPrefs.pas` |
 | Single-instance mutex + broadcast | `delphi-backend/Source/PM.SingleInstance.pas` |
+| Start with Windows (HKCU Run) | `delphi-backend/Source/PM.AutoStart.pas` |
 | Handlers REST | `delphi-backend/Handlers/PM.Handler.*.pas` |
 | Frontend complet | `js/app.js` |
 | HTML racine | `index.html` |
@@ -51,6 +52,7 @@ Commandes connues :
 - `clipboard/copy`, `clipboard/clear`, `clipboard/read` (Paste custom menu)
 - `quickunlock/{store,get,clear,status}`
 - `prefs/{get,set}?key=...` (device-bound DPAPI key/value, voir plus bas)
+- `autostart/{get,set}?enabled=1|0` (HKCU Run registry, "Start with Windows")
 - `autofill/{configure,hotkeys,execute,cancel}`
 - `app/focus` (ramène la fenêtre au premier plan, pour le picker)
 - `app/ready` (page chargée → SetFocus WebBrowser + DOM focus auth input)
@@ -156,6 +158,21 @@ la fenêtre + clipboard clear + balloon first-time.
 Menu : Open / Lock vault / Quit (via `TrackPopupMenu`, themé par
 `SetPreferredAppMode` ci-dessus).
 
+## Start with Windows (`PM.AutoStart`)
+
+- Toggle dans Settings → "Start with Windows" (visible seulement quand
+  `Bridge.active`)
+- Mécanisme : `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`,
+  valeur `"PMServer"` = `"<exe-path>" -tray` (single dash — `--tray`
+  ne match pas `FindCmdLineSwitch`)
+- Per-user, pas d'admin requis. Visible dans Task Manager → Startup tab
+- Toggle "on" = registered AND la valeur pointe vers notre exe courant
+  (un old entry d'un exe déplacé lit comme "off" → user peut re-enable
+  pour rafraîchir le path)
+- CLI flag `-tray` (`FindCmdLineSwitch('tray', True)`) dans FormCreate
+  → `FBridge.MinimizeToTray` via `TThread.ForceQueue` (defer après la
+  show initiale FMX pour minimiser le flash)
+
 ## Device-bound prefs (`PM.UserPrefs`)
 
 **Problème résolu** : le serveur HTTP bind un port éphémère aléatoire