feat(app): dragging Uplink to the Trash leaves a LaunchAgent pointing at a missing binary

Part of #5.

What is there today

There is no uninstall for the downloaded app: no menu item, no script, nothing in the README. Dragging Uplink.app to the Trash leaves behind:

• ~/Library/LaunchAgents/com.stacksjs.uplink.plist (app/Uplink/desktop-agent.ts#L40, written by setOpenAtLogin at #L113), which at the next login tries to run a deleted executable.
• The Keychain item, service com.stacksjs.uplink, account claude-oauth-token (app/Uplink/settings.ts#L19).
• ~/Library/Application Support/Uplink: settings.json, uplink.sqlite, uplink.pid (app/Uplink/settings.ts#L14).
• ~/Library/Logs/Uplink.log (app/Uplink/settings.ts#L17).
• The Full Disk Access and Automation grants, which only the person can remove.

The from-source side has buddy uplink:uninstall (app/Uplink/service.ts#L139), so the two paths are uneven.

There is also a related sharp edge. Both installs share the launchd label com.stacksjs.uplink (app/Uplink/service.ts#L12, app/Uplink/desktop-agent.ts#L30), which is deliberate and stops both answering texts at once. retireOtherInstall (app/Uplink/desktop-agent.ts#L87) stops the other one when the app starts. But it only runs on start, so a person who then runs buddy uplink:install gets the source service and the app fighting over the label with no warning.

Proposal

1. Add "Uninstall Uplink" to the tray menu: stop the watcher, remove the LaunchAgent, delete the Keychain item, and offer to remove the data directory and the log.
2. Say what it cannot remove. The Full Disk Access and Automation grants are the person's to revoke, so name the two panes.
3. Have buddy uplink:install notice the app is installed and say so before taking the label, rather than silently winning.
4. Document both uninstalls in the README, which currently documents only the source one (README.md#L101).

Requirements

• Removing the app must never leave a login item pointing at nothing. That is the one consequence a person cannot discover or fix without knowing launchd exists.
• Deleting the data directory is opt-in, separately confirmed. It holds the run history.
• The Keychain item goes without asking. It is a credential and the app is being removed.

Acceptance

• After uninstalling, no com.stacksjs.uplink LaunchAgent exists and nothing runs at the next login.
• The Keychain item is gone and the data directory removal was the person's choice.
• buddy uplink:install on a Mac running the app says so instead of quietly taking over.