feat(autostart): "Start with Windows" toggle

- PM.AutoStart wraps HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
  Value "PMServer" = "<exe>" -tray. Per-user, no admin required, shows
  up in Task Manager → Startup so the user can override from there.

- UMainForm honours the -tray CLI flag (set by the registry entry):
  after the server starts, MinimizeToTray via TThread.ForceQueue so the
  app comes up directly in the tray with no visible window flash.

- Bridge cmd://autostart/{get,set} + Bridge.getAutoStart() /
  setAutoStart() / onAutoStartStatus(). Settings exposes a toggle in
  the Security section, visible only when Bridge.active (the PHP
  frontend can't touch the registry).

- Toggle reads "on" only when the registered command matches the
  current exe path, so a stale entry from a moved exe lets the user
  re-enable to refresh.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/UMainForm.pas

@@ -11,7 +11,7 @@ uses
   FMX.Dialogs, FMX.DialogService,
   FMX.TMSFNCTypes, FMX.TMSFNCUtils, FMX.TMSFNCGraphics, FMX.TMSFNCGraphicsTypes,
   FMX.TMSFNCCustomControl, FMX.TMSFNCWebBrowser,
-  PM.HTTPServer, PM.Bridge, PM.QuickUnlock, PM.UserPrefs;
+  PM.HTTPServer, PM.Bridge, PM.QuickUnlock, PM.UserPrefs, PM.AutoStart;
 
 type
   TMainForm = class(TForm)
@@ -131,6 +131,20 @@ begin
   end;
   btnStartClick(Nil);
   btnToggleLogClick(nil);
+
+  // CLI flag --tray (set by the "Start with Windows" registry entry):
+  // launch directly into the tray instead of popping a window during
+  // the Windows login. Defer to ForceQueue so the form has finished its
+  // initial Show before we hide it — minimises the visible flash.
+  if FindCmdLineSwitch('tray', True) then
+  begin
+    TThread.ForceQueue(nil,
+      procedure
+      begin
+        FBridge.MinimizeToTray;
+        LogLine('Launched with --tray, minimised at startup');
+      end);
+  end;
 end;
 
 procedure TMainForm.FormDestroy(Sender: TObject);
@@ -552,6 +566,28 @@ begin
     PM.UserPrefs.SetPref(LKey, GetParam('value'));
   end
 
+  // ---- Start with Windows (HKCU Run registry) --------------------------
+  else if ACmd = 'autostart/get' then
+  begin
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onAutoStartStatus)' +
+      'Bridge.onAutoStartStatus(' +
+      BoolToStr(PM.AutoStart.IsAutoStartEnabled, True).ToLower + ')');
+  end
+
+  else if ACmd = 'autostart/set' then
+  begin
+    var LOk := PM.AutoStart.SetAutoStart(GetParam('enabled') = '1');
+    LogLine(Format('Autostart set to %s (ok=%s)',
+      [GetParam('enabled'), BoolToStr(LOk, True)]));
+    // Echo back the resulting state so the UI re-syncs (covers the
+    // case where the registry write was blocked silently).
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onAutoStartStatus)' +
+      'Bridge.onAutoStartStatus(' +
+      BoolToStr(PM.AutoStart.IsAutoStartEnabled, True).ToLower + ')');
+  end
+
   else
     LogLine('Bridge: unknown command "' + ACmd + '"');
 end;