feat: detect disabled Login Item and show helpful message instead of re-prompting

Check SMAppService.daemon().status before falling through to reinstall.
If the user disabled VPN Bypass in System Settings → Login Items, show
a specific error message instead of triggering the admin password prompt.
Closes #25

Author: GeiserX

Resources/en.lproj/Localizable.strings

@@ -89,6 +89,7 @@
 "Error: %@" = "Error: %@";
 "Installation failed" = "Installation failed";
 "Cannot connect to helper after reinstall" = "Cannot connect to helper after reinstall";
+"Please enable VPN Bypass in System Settings → General → Login Items" = "Please enable VPN Bypass in System Settings → General → Login Items";
 "Helper update failed: %@" = "Helper update failed: %@";
 "Helper update did not take effect (got %@, expected %@)" = "Helper update did not take effect (got %@, expected %@)";
 "unknown" = "unknown";

Resources/es.lproj/Localizable.strings

@@ -89,6 +89,7 @@
 "Error: %@" = "Error: %@";
 "Installation failed" = "La instalación falló";
 "Cannot connect to helper after reinstall" = "No se puede conectar al asistente tras reinstalar";
+"Please enable VPN Bypass in System Settings → General → Login Items" = "Activa VPN Bypass en Ajustes del Sistema → General → Ítems de inicio";
 "Helper update failed: %@" = "La actualización del asistente falló: %@";
 "Helper update did not take effect (got %@, expected %@)" = "La actualización del asistente no surtió efecto (obtenido %@, esperado %@)";
 "unknown" = "desconocido";

Resources/fr.lproj/Localizable.strings

@@ -89,6 +89,7 @@
 "Error: %@" = "Erreur : %@";
 "Installation failed" = "L'installation a échoué";
 "Cannot connect to helper after reinstall" = "Impossible de se connecter à l'assistant après réinstallation";
+"Please enable VPN Bypass in System Settings → General → Login Items" = "Activez VPN Bypass dans Réglages du système → Général → Ouverture";
 "Helper update failed: %@" = "La mise à jour de l'assistant a échoué : %@";
 "Helper update did not take effect (got %@, expected %@)" = "La mise à jour de l'assistant n'a pas pris effet (obtenu %@, attendu %@)";
 "unknown" = "inconnu";

Sources/HelperManager.swift

@@ -48,6 +48,18 @@ final class HelperManager: ObservableObject {
     /// XPC timeout for all helper RPCs (seconds)
     private let xpcTimeout: TimeInterval = 10
 
+    /// Check if the helper daemon is disabled in System Settings → Login Items.
+    /// Returns true if the daemon is blocked by the user, meaning we should NOT
+    /// attempt reinstall (it would just prompt again next boot).
+    @available(macOS 13.0, *)
+    private func isDaemonDisabledByUser() -> Bool {
+        let service = SMAppService.daemon(plistName: "\(kHelperToolMachServiceName).plist")
+        let status = service.status
+        // .notRegistered means the user toggled it off in Login Items, or it was never registered
+        // .requiresApproval means macOS is blocking it pending user approval
+        return status == .notRegistered || status == .requiresApproval
+    }
+
     private init() {
         // Only set initial state — do NOT start route application here.
         // The app must call ensureHelperReady() before using helper RPCs.
@@ -97,6 +109,13 @@ final class HelperManager: ObservableObject {
         let version = await getVersionWithTimeout()
 
         guard let version = version else {
+            // Check if the user disabled the background item in System Settings
+            if #available(macOS 13.0, *), isDaemonDisabledByUser() {
+                print("🔐 Helper daemon disabled by user in System Settings")
+                helperState = .failed(String(localized: "Please enable VPN Bypass in System Settings → General → Login Items"))
+                return false
+            }
+
             // XPC connection failed — helper may be corrupted or wrong arch
             print("🔐 Helper XPC connection failed, attempting reinstall...")
             helperState = .installing