fix(installer): Theta Directory branding, visible URL/join-key fields, GUI tray, service autostart

User-reported install fixes:

- Branding: every user-facing 'SSO Manager' string now says 'Theta Directory'
  (agent logs, CLI usage, agent.yml.example, installer wizard).
- Wizard page: the URL/join-key text boxes were never shown. The layout used
  Surface.Width (0 at wizard init) instead of SurfaceWidth and combined
  WordWrap with AutoSize (mutually exclusive in VCL). Rewritten with the
  canonical Inno pattern (SurfaceWidth + ScaleY + explicit label height).
- No console window after install: the tray and helper now build as
  GUI-subsystem binaries (-H=windowsgui) in build_all.sh and
  scripts/setup-build-env.ps1. The agent stays a console app for foreground
  debugging (as a service it never shows a console).
- The daemon never came up after install: install-service now starts the
  service immediately, so the tray IPC socket exists right away and the tray
  connects instead of logging 'actively refused' until a reboot.

Verified: go build/vet/test green; tray+helper PE subsystem = GUI (2), agent =
console (3); installer compiles; tray runs silently.

cli.go

@@ -55,7 +55,7 @@ func printUsage() {
 	fmt.Println("  theta-agent                         Run agent daemon in foreground")
 	fmt.Println("  theta-agent get-secret <key>        Fetch single secret value from OpenBao")
 	fmt.Println("  theta-agent get-secrets [flags]     Fetch all host/resource secrets (flags: --json, --env)")
-	fmt.Println("  theta-agent update                  Self-update binary from SSO Manager")
+	fmt.Println("  theta-agent update                  Self-update binary from Theta Directory")
 	fmt.Println("  theta-agent reinitialize [flags]   Reset enrollment credentials & re-register")
 	fmt.Println("  theta-agent install-service        (Windows) register the agent as a service")
 	fmt.Println("  theta-agent remove-service         (Windows) unregister the agent service")