multica_agent_host: daemon lifecycle via systemd; fix login guard (WDWL-22)

Found provisioning spaceship-earth:

- Login was not idempotent: `multica auth status` prints to stderr (0.6.5),
  and the guard read stdout only, so every run re-logged in and restarted
  the daemon. The guard now reads both streams; the status read is no_log
  because it echoes a token prefix.
- `multica daemon start` / `daemon restart` fork the daemon inside the
  caller's session (Ansible's SSH session scope), outside the systemd user
  unit, which stays inactive: the same orphan seen on haunted-mansion on
  2026-10-21. Start/restart now go through `systemctl --user`, after a
  daemon-reload when autostart was (re)registered. A daemon found running
  outside its unit is stopped first. The unit name is read from
  `autostart status`, so --profile hosts resolve their own unit.

spaceship-earth: second run changed=0, daemon in multica-daemon.service.
Not yet run against haunted-mansion.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/handlers/main.yml

@@ -1,7 +1,9 @@
 ---
+# Through systemd, not `multica daemon restart`: that respawns the daemon in
+# the caller's session, outside the unit (see tasks/daemon.yml).
 - name: Restart multica daemon
   ansible.builtin.command:
-    argv: "{{ _multica_cmd + ['daemon', 'restart'] }}"
+    argv: [systemctl, --user, restart, "{{ _multica_unit | default('multica-daemon.service') }}"]
   become: true
   become_user: "{{ multica_user }}"
   environment: "{{ _multica_user_env }}"