feat: add flm service subcommand for systemd integration

[thunderbug1]

Summary

• Adds flm service <install|uninstall|start|stop|status> to manage FastFlowLM as a systemd service
• Install creates a dedicated flm system user, generates a wrapper script and config under /etc/flm/, and installs a hardened systemd unit
• Resolves model path from the installing user's home via SUDO_USER so the service can read models without the flm user needing to own them

Solves: #541

New files

• src/include/service.hpp — declarations
• src/src/service.cpp — install/uninstall/start/stop/status logic

Modified files

• src/include/utils/vm_args.hpp — add service to help text, allow --host/--port for service command
• src/src/main.cpp — add service dispatch branch

Service details

flm service install (requires sudo):

• Creates a flm system user with no login shell
• Adds flm user to the render group for NPU access (/dev/accel/accel*)
• Resolves model path from SUDO_USER's home directory
• Writes /etc/flm/service.conf (host, port, model path)
• Writes /etc/flm/flm-service-wrapper (executable wrapper script)
• Writes /etc/systemd/system/flm.service (hardened unit with ProtectSystem=strict, NoNewPrivileges=true, etc.)
• Enables the service for auto-start

flm service status does not require root.

Test plan

• Build succeeds with the new files
• flm --help shows the service command
• flm service without subcommand shows usage error
• flm service install without sudo shows root error
• flm service status delegates to systemctl (confirmed "Unit flm.service could not be found")
• flm service install --host 0.0.0.0 --port 8000 creates all files correctly
• /etc/flm/service.conf has correct model path from installing user's home
• /etc/flm/flm-service-wrapper is executable and has correct binary path
• /etc/systemd/system/flm.service has correct hardened settings
• flm service start starts the service and it stays running
• flm service status shows active status
• flm service stop stops the service
• flm service uninstall cleans up all files
• Service can serve API requests after start (test with curl to the configured port)
• journalctl -u flm shows FLM startup logs
• Double install is rejected with message to uninstall first

[Atomic-Germ]

I've been using a user service for that, which seems to work flawlessly. It's a workaround I guess but it isn't a hard one at least.