[Deployment] Run and recover services with launchd on the Mac mini

[troyscott]

Outcome

Operate the reader reliably on an always-on Mac mini without manual terminal sessions.

Acceptance criteria

• Least-privilege runtime user and filesystem permissions are documented.
• Reader and admin launch agents restart safely.
• Logs exclude secrets and have a retention policy.
• Backup and publication rollback procedures are tested.
• Upgrade and reboot runbooks are documented.