Do not open a window when provisioning hits the port-recovery path

--provision-sync-account exits before the normal windowed launch, so it
looked headless -- but only on the happy path. When port 8730 is already
held, main() detours through _recoverPort first, and AttachToExisting opens
a browser window unless --no-browser was passed. It did not know about
--provision-sync-account, so the second and later provisioning runs opened a
full --app= window on the primary monitor: exactly what the headless flag
exists to avoid.

Found by running the feature twice rather than once. The first run binds the
port and stays headless; only the second reveals it.

Verified after the fix: two consecutive provisioning runs, both exit 0, zero
windows opened.

diet-guard is unaffected -- its wrapper has no port-recovery path.

256 tests, analyzer clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177xwzcpfpWG2qca8Mr39q9

bin/todo_desktop.dart

@@ -128,7 +128,12 @@ Future<bool> _recoverPort(
       // and window count goes 1 -> 2). A duplicate window is the right
       // trade-off anyway: both share this one server and one IndexedDB, and
       // typing `todo` to get nothing visible would be worse.
-      final opening = !args.contains('--no-browser');
+      // --provision-sync-account counts as "do not open a window" too: it
+      // is a headless setup step, and opening one here defeated the whole
+      // point (it landed fullscreen on the primary monitor).
+      final opening =
+          !args.contains('--no-browser') &&
+          !args.contains('--provision-sync-account');
       stdout.writeln(
         'todo is already running (pid $pid)'
         '${opening ? '; opening a window.' : '.'}',