Add native Windows relay support

[AsafMah]

Summary

• add a PowerShell relay launcher for Windows
• support local-only, temporary Cloudflare, and named Cloudflare modes
• default to loopback-only, local-only operation
• require HERDR_RELAY_TOKEN for public tunnels and non-loopback listeners
• discover herdr from PATH while preserving HERDR_BIN
• use a Windows-appropriate log directory
• run plugin hooks through uv run --script across Windows, macOS, and Linux
• preserve pushed status events during transient polling failures
• serialize subprocess calls per SSH target without blocking unrelated targets
• document Windows setup, authentication, plugin linking, tunnels, and bundled clients
• add Windows/plugin/relay behavior tests

Motivation

Herdi.app is macOS-only, but the Python relay and its web, TUI, and Telegram clients are otherwise cross-platform. Windows users currently need undocumented setup and encounter platform assumptions around executable discovery, logging, plugin execution, startup, and signal handling.

This enables the existing relay and clients on Windows without adding a native tray application.

Security

• relay binds to 127.0.0.1 by default
• launcher defaults to HERDR_TUNNEL_MODE=none
• tokens are required for temporary/named tunnels and non-loopback binds
• direct relay execution enforces the same non-loopback rule
• bundled clients can authenticate with a token-bearing HERDR_RELAY URL

Verification

• tests/run.sh: 18 passed, 0 failed
• relay/plugin behavior tests: 11 passed
• PowerShell launcher starts and stops the relay process tree
• branch is one clean commit over main

Scope

This does not add a native Windows tray application.

[bradydibble]

Merge conflict against current main — can you rebase contrib/windows-relay onto main? Conflicting files: QUICKSTART.md, README.md, relay/herdr_relay.py, tests/run.sh. CI (GitGuardian) is green on the branch. Once conflicts are resolved I'll review and approve.