dsh-remote 0.3.0: one-line macOS slave install

- deploy/install-mac.sh: per-user Node 22 (checksum-verified), DSH + pnpm in
  ~/.local, dsh-remote from the repo archive, pairing, LaunchAgent dsh web
- deploy/pair.mjs: pair without a running DSH (detects login-proxy redirects)
- install-local.mjs: --accept secrets list, --restart-on-sync
- sync.restartOnSync: slave restarts itself after synced plugins change
  (waits for idle sessions, at most once per 10 min)

README.md

@@ -30,6 +30,28 @@ systemctl --user restart dsh    # or restart `dsh web` however you run it
 
 `deploy/dsh-web.user.service` is a ready-made systemd user unit for a rootless `dsh web` (127.0.0.1:3081).
 
+### macOS: one-line slave install
+
+Create a pairing code on the master (Settings → *Remote devices* → **Create pairing code**). Then, in Terminal on the Mac:
+
+```bash
+curl -fsSL https://git.rizzy.dev/DSH-Plugins/dsh-remote/raw/branch/main/deploy/install-mac.sh \
+  | bash -s -- --master http://192.168.0.111:3080 --code XXXX-XXXX-XXXX-XXXX --name my-mac
+```
+
+No sudo and no Homebrew. The script:
+
+- installs Node 22 to `~/.local/opt/node` (checksum-verified), and DSH and pnpm to `~/.local`;
+- puts dsh-remote in `~/.dsh/plugins/dsh-remote` and registers it as a slave that accepts `OMNI_API_KEY` and `FORGE_CREDENTIALS` (`--accept` changes the list);
+- pairs with the code (`deploy/pair.mjs`, no running DSH needed);
+- installs the LaunchAgent `dev.rizzy.dsh-web`: `dsh web` on 127.0.0.1:3081, started at login and restarted if it dies. Logs go to `~/.dsh/logs/`.
+
+On first link-up the Mac pulls the master's plugins and config. With `sync.restartOnSync: true`, set by the script, DSH restarts itself once so new plugins load. It waits until no session is running and restarts at most once per 10 minutes.
+
+Re-running the script updates everything and keeps the pairing. To remove it: `launchctl bootout gui/$(id -u)/dev.rizzy.dsh-web`, then delete `~/Library/LaunchAgents/dev.rizzy.dsh-web.plist`, `~/.dsh` and `~/.local/opt/node`.
+
+Away from home, use `--master https://dsh.rizzy.dev` once the edge exempts `/dsh-remote/link` and `/dsh-remote/enroll` from Authentik (see below).
+
 ## Pair a device
 
 1. **Master:** Settings → *Remote devices* → **Create pairing code** (single use, valid 15 min).
@@ -86,6 +108,7 @@ GitHub `gh` logins are not shipped.
     publicUrl: https://dsh.rizzy.dev
     sync:
       auto: true            # slave: sync on link-up and when the master pushes
+      restartOnSync: false  # slave: restart DSH itself after plugins change (needs a service manager)
       allow: []             # slave: only these bundles (exact or prefix*)
       deny: []              # slave: never these bundles (wins over allow)
       secrets: []           # slave: credential refs it accepts from the master (+ FORGE_CREDENTIALS)