dsh-remote 0.3.0: one-line macOS slave install

- deploy/install-mac.sh: per-user Node 22 (checksum-verified), DSH + pnpm in
  ~/.local, dsh-remote from the repo archive, pairing, LaunchAgent dsh web
- deploy/pair.mjs: pair without a running DSH (detects login-proxy redirects)
- install-local.mjs: --accept secrets list, --restart-on-sync
- sync.restartOnSync: slave restarts itself after synced plugins change
  (waits for idle sessions, at most once per 10 min)

deploy/install-local.mjs

@@ -42,6 +42,7 @@ try { patch = fs.readFileSync(patchFile, 'utf8') } catch { patch = '' }
 if (!/^- id: dsh-remote\b/m.test(patch)) {
   const role = opt('role', 'auto')
   const name = opt('name', '')
+  const accept = String(opt('accept', '')).split(',').map((s) => s.trim()).filter((s) => /^[A-Z][A-Z0-9_]*$/.test(s))
   const block = [
     '# dsh-remote (installed by deploy/install-local.mjs)',
     '- id: dsh-remote',
@@ -50,9 +51,10 @@ if (!/^- id: dsh-remote\b/m.test(patch)) {
     `    deviceName: ${JSON.stringify(name)}`,
     '    sync:',
     '      auto: true',
+    `      restartOnSync: ${args.includes('--restart-on-sync') ? 'true' : 'false'}`,
     '      allow: []',
     '      deny: []',
-    '      secrets: []',
+    accept.length ? `      secrets:\n${accept.map((s) => `        - ${s}`).join('\n')}` : '      secrets: []',
     '',
   ].join('\n')
   // An empty/comment-only patch file fails DSH boot, so only append real entries.