T-124: unix-domain IPC server, wired into Flutter app boot

First slice of T-99 (the D-56-path-a IPC server). What this lands:

* lib/src/ipc/paths.dart rewritten — `workspaceSocketPath(root)`
  returns the per-workspace path per D-70 (FNV-1a 64-bit hash, hex,
  no crypto dep — D-70 amended in this commit to record the hash
  choice). Old `defaultSocketPath()` removed; the lone fallback in
  facade.dart kept with a clear placeholder pending T-127.
* lib/src/ipc/server.dart — IpcServer class. ServerSocket.listen
  accept loop (D-72), 0600 socket + 0700 parent (D-71), stale-node
  probe + unlink on start, refuses to clobber a live listener.
* lib/main.dart — IpcServer started after the first dispatcher is
  built and swapped on project open (workspace path changes).
  Failure logged but non-fatal so the UI still works without IPC.
* 11 server tests + 5 path tests cover socket modes, multi-conn,
  stale unlink, live-conflict, idempotent start/stop.

T-99 children downstream of T-124 (T-125 / T-126 / T-127 / T-130)
are now unblocked.

Co-Authored-By: Claude <noreply@anthropic.com>

test/ipc/paths_test.dart

@@ -1,28 +1,47 @@
 import 'dart:io';
 
-import 'package:clide/clide.dart';
+import 'package:clide/src/ipc/paths.dart';
 import 'package:test/test.dart';
 
 void main() {
-  group('defaultSocketPath', () {
-    final originalXdg = Platform.environment['XDG_RUNTIME_DIR'];
-    final originalUser = Platform.environment['USER'];
+  group('workspaceSocketPath (D-70)', () {
+    test('returns the FNV-1a hashed path under the socket directory', () {
+      final p = workspaceSocketPath('/home/me/projects/clide');
+      expect(p, startsWith('${socketDirectory()}/'));
+      expect(p, endsWith('.sock'));
+      // 16-char hex hash.
+      final hash = p.split('/').last.replaceAll('.sock', '');
+      expect(hash, matches(RegExp(r'^[0-9a-f]{16}$')));
+    });
 
-    test('uses XDG_RUNTIME_DIR when set', () {
-      // We can't mutate Platform.environment from dart:io, so this test
-      // just asserts the path shape for the current env. CI and dev
-      // boxes both have meaningful USER values.
-      final path = defaultSocketPath();
-      expect(path, endsWith('.sock'));
-      expect(path, contains('clide-'));
-      if (originalXdg != null && originalXdg.isNotEmpty) {
-        expect(path, startsWith(originalXdg));
+    test('is deterministic for the same input', () {
+      expect(
+        workspaceSocketPath('/home/me/repo'),
+        workspaceSocketPath('/home/me/repo'),
+      );
+    });
+
+    test('different workspace roots hash to different paths', () {
+      expect(
+        workspaceSocketPath('/home/me/repo-a'),
+        isNot(workspaceSocketPath('/home/me/repo-b')),
+      );
+    });
+
+    test('socketDirectory uses XDG_RUNTIME_DIR on Linux when set', () {
+      if (Platform.isMacOS) return;
+      final xdg = Platform.environment['XDG_RUNTIME_DIR'];
+      if (xdg != null && xdg.isNotEmpty) {
+        expect(socketDirectory(), '$xdg/clide');
       } else {
-        expect(path, startsWith('/tmp'));
-      }
-      if (originalUser != null && originalUser.isNotEmpty) {
-        expect(path, contains('clide-$originalUser'));
+        expect(socketDirectory(), '/tmp/clide');
       }
     });
+
+    test('socketDirectory uses ~/Library/Caches on macOS', () {
+      if (!Platform.isMacOS) return;
+      final home = Platform.environment['HOME']!;
+      expect(socketDirectory(), '$home/Library/Caches/clide');
+    });
   });
 }