feat(windows): add windows-service crate + SCM dispatcher scaffold

Lets numa.exe act as a real Windows service registered with the SCM,
replacing the HKLM\...\Run login-time autostart that runs in the user
session without stderr capture.

- New `numa::windows_service` module (cfg(windows)) wraps Mullvad's
  `windows-service` crate: registers with SCM, reports Running, handles
  Stop/Shutdown, reports Stopped.
- `numa.exe --service` is the entry point SCM uses
  (`sc create … binPath="numa.exe --service"`); interactive invocations
  are unchanged.
- Dep is gated `[target.'cfg(windows)'.dependencies]` — zero impact on
  macOS/Linux builds or binary size.

Scaffold only. The service currently blocks on an mpsc channel until
Stop arrives; the actual serve loop will hook in once main.rs's inline
server body is extracted into `numa::serve(config_path)` in a follow-up.
This lets `sc start Numa` / `sc stop Numa` be verified end to end today.

src/main.rs

@@ -32,6 +32,14 @@ async fn main() -> numa::Result<()> {
     // Handle CLI subcommands
     let arg1 = std::env::args().nth(1).unwrap_or_default();
     match arg1.as_str() {
+        #[cfg(windows)]
+        "--service" => {
+            // Entry point used by Windows SCM (`sc create … binPath="numa.exe --service"`).
+            // Hands control to the service dispatcher and blocks until Stop.
+            numa::windows_service::run_as_service()
+                .map_err(|e| format!("windows service dispatcher failed: {}", e))?;
+            return Ok(());
+        }
         "install" => {
             eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — installing\n");
             return install_service().map_err(|e| e.into());