multica_agent_host: daemon lifecycle via systemd; fix login guard (WDWL-22)

Found provisioning spaceship-earth:

- Login was not idempotent: `multica auth status` prints to stderr (0.6.5),
  and the guard read stdout only, so every run re-logged in and restarted
  the daemon. The guard now reads both streams; the status read is no_log
  because it echoes a token prefix.
- `multica daemon start` / `daemon restart` fork the daemon inside the
  caller's session (Ansible's SSH session scope), outside the systemd user
  unit, which stays inactive: the same orphan seen on haunted-mansion on
  2026-10-21. Start/restart now go through `systemctl --user`, after a
  daemon-reload when autostart was (re)registered. A daemon found running
  outside its unit is stopped first. The unit name is read from
  `autostart status`, so --profile hosts resolve their own unit.

spaceship-earth: second run changed=0, daemon in multica-daemon.service.
Not yet run against haunted-mansion.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/tasks/auth.yml

@@ -1,6 +1,10 @@
 ---
 # `multica auth status` prints the server and user when authenticated and exits
 # non-zero otherwise, so it is the idempotency guard for login.
+#
+# It prints to STDERR, not stdout (0.6.5). A stdout-only guard never matches,
+# so every run re-logs in and restarts the daemon. It also echoes a token
+# prefix, hence no_log.
 - name: Auth | Read the current authentication state
   ansible.builtin.command:
     argv: "{{ _multica_cmd + ['auth', 'status'] }}"
@@ -11,13 +15,15 @@
   changed_when: false
   failed_when: false
   check_mode: false
+  no_log: true
 
 - name: Auth | Decide whether a login is needed
   ansible.builtin.set_fact:
     _multica_needs_login: >-
       {{ multica_force_relogin | bool
          or _multica_auth_status.rc != 0
-         or multica_server_url.rstrip('/') not in (_multica_auth_status.stdout | default('')) }}
+         or multica_server_url.rstrip('/') not in
+            ((_multica_auth_status.stdout | default('')) ~ (_multica_auth_status.stderr | default(''))) }}
 
 # no_log is mandatory: without it Ansible records the full argv — including the
 # PAT — in play output, CI logs, and every callback plugin.