[madeofpendletonwool]

Adds pinepods_firewood --headless: the player and the now-playing socket with no TUI, so a Pi or speaker box is always there as a device to play on. Phase 5 of the overhaul.

• Login: FIREWOOD_SERVER + FIREWOOD_API_KEY (or FIREWOOD_API_KEY_FILE) win over the session the TUI saved. Keys from the environment are never saved. Unreachable server → retry with backoff (2–60 s); rejected key → exit 1.
• Lifecycle: logs go to stderr as well as the file (stderr only if the file can't be opened); SIGTERM/SIGINT/SIGHUP saves the position and closes the socket. FIREWOOD_REMOTE_DISABLED with --headless is an error.
• CLI: --version (the Homebrew formula's test runs it, and before this it started the TUI) and --help.
• Refactor: the startup shared by the TUI and headless moves into src/services.rs.
• Services: pkg/systemd/firewood.service (user unit) and pkg/launchd/online.pinepods.firewood.plist. README section added.

Verification

• cargo fmt --check, clippy -D warnings and cargo test all pass. New unit tests cover argument parsing and the key file.
• Live: headless Firewood → local now-playing relay → read-only proxy → the production server, so every write was faked. Volume was 0 and media keys were off. A scripted peer passed 13/13 checks: listed idle with its capabilities; play_episode with position_sec 600 started at 600; pause, seek, play and skip_forward were each acked and reported; after SIGTERM it left the device list at once, exited 0, and its save went to record_listen_duration (faked).
• Also live: retry while the server is down, then a login once it came up; SIGINT during the retry exits right away; a rejected key exits 1 with a clear error; login from a saved session; SIGHUP; the error paths for missing or empty credentials and an unwritable log directory.
• plutil -lint passes on the plist, and systemd-analyze verify passes on the unit (in a Debian container).

Not tested

• Running on a real Raspberry Pi or Linux box, and running under systemd or launchd themselves.
• Against a real PinePods socket rather than the relay, which copies the server's protocol.
• Headless with media keys on.