支持自动故障转移的原子化非交互恢复

[wplct]

依赖 / Depends on: #400 修复自动故障转移中的供应商凭证串号。该依赖合并后，本分支会 rebase 到最新 main 再提交上游。

问题

非交互环境中没有安全的单命令方式同时启动 proxy worker 和自动故障转移。若脚本先执行 proxy enable、再执行 failover enable，worker 第一次接管发生在 auto_failover_enabled 落库之前，存在按手动模式处理 live 配置的中间窗口。

同时，failover enable 在需要 bootstrap proxy 时会显示交互确认，无法直接用于 systemd ExecStartPost 或自动化脚本。

修复

• 为 failover enable 增加 --yes，仅跳过 proxy bootstrap 确认；默认交互行为保持不变。
• 组合启用在启动 daemon worker 前暂存 (enabled=true, auto_failover_enabled=true)，使 worker 第一次 takeover 就按自动故障转移语义运行。
• staging 写入失败或 worker 启动失败时，统一回滚 live backup、failover snapshots、current provider 和 routing flags。
• EnsureWorker 返回错误后先对账 daemon worker 与 live takeover 状态：
  • worker 和 live takeover 均已生效时，视为响应丢失但操作成功；
  • 只有 worker 存活但 takeover 未完成时，才发送幂等 DropTakeover 补偿；
  • 无 worker 时直接执行本地 rollback。
• 补偿清理失败和状态回滚失败会分别聚合到错误信息中。

测试

• failover enable 默认 yes=false。
• failover enable --yes 正确解析为非交互确认。
• worker 启动前 proxy/auto-failover flags 已同时落库。
• managed session 启动失败后恢复 live、backup、snapshot、current provider 和 flags。

部署说明

本 PR 不提交任何 systemd unit。部署方可以在 binary 更新后使用：

ExecStartPost=/path/to/cc-switch --app codex failover enable --yes

Depends on the provider credential isolation PR. After that dependency is merged, this branch will be rebased onto the latest main before submitting it upstream.

Problem

There is no safe single-command path for starting both the proxy worker and automatic failover in a non-interactive environment. Running proxy enable followed by failover enable creates an intermediate window where the worker performs its first takeover before auto_failover_enabled is persisted, so the live configuration may be handled with manual-takeover semantics.

In addition, failover enable prompts for confirmation when proxy bootstrap is required, preventing direct use from systemd ExecStartPost and automation scripts.

Fix

• Add failover enable --yes, which only skips the proxy-bootstrap confirmation. Default interactive behavior remains unchanged.
• Stage (enabled=true, auto_failover_enabled=true) before starting the daemon worker, so its first takeover uses automatic-failover semantics.
• Use one rollback path for staging failures and worker-start failures, restoring the live backup, failover snapshots, current provider, and routing flags.
• Reconcile daemon state after an EnsureWorker error:
  • if both the managed worker and live takeover are active, treat it as a lost response after successful completion;
  • send idempotent DropTakeover compensation only when a worker exists but takeover did not complete;
  • perform local rollback directly when no managed worker exists.
• Aggregate worker-cleanup and state-rollback failures independently in the returned error.

Tests

• failover enable defaults to yes=false.
• failover enable --yes parses as non-interactive confirmation.
• Proxy and automatic-failover flags are persisted before worker startup.
• A managed-session startup failure restores live config, backups, snapshots, current provider, and flags.

Deployment note

This PR does not add or modify a systemd unit. Deployments may use the following after updating the binary:

ExecStartPost=/path/to/cc-switch --app codex failover enable --yes