fix(cli,plugin): CLAUDE_MAILBOX_URL env override + port-conflict-aware doctor

The plugin's UserPromptSubmit and SessionStart hooks call `claude-mailbox`
with no --url flag, so they previously always hit the hardcoded
http://127.0.0.1:47822/mcp default. If port 47822 was held by another
local service (e.g. ClaudeDo), the daemon couldn't bind there and every
hook was talking to the wrong process.

CLI default for --url now resolves to $CLAUDE_MAILBOX_URL when set,
falling back to http://127.0.0.1:47822. Doctor gained a Step 2 that
probes /health on 47822, identifies foreign occupants, picks a free
port, writes both ~/.claude-mailbox/mailbox.json and the
CLAUDE_MAILBOX_URL entry in .claude/settings.json env so the hooks
follow along automatically.

Also adds a fallback hint when Windows schtasks /Create fails with
Access is denied (Group Policy restricts non-admin task creation): run
install-autostart from an elevated shell, or accept an ephemeral serve
for the current session.

node/src/cli.ts

@@ -35,7 +35,9 @@ function readVersion(): string {
   }
 }
 
-const DEFAULT_URL = `http://127.0.0.1:${DEFAULT_PORT}`;
+const HARDCODED_DEFAULT_URL = `http://127.0.0.1:${DEFAULT_PORT}`;
+const ENV_URL = (process.env["CLAUDE_MAILBOX_URL"] ?? "").trim();
+const DEFAULT_URL = ENV_URL || HARDCODED_DEFAULT_URL;
 
 async function callJson(
   method: string,