Add Mdm auto start flag doc (#855)

* MDM disableAutoStart flag

* Added note on desktop only mode

src/pages/client/mdm-integration.mdx

@@ -71,6 +71,7 @@ PascalCase variant in the Group Policy Editor — both are recognized.
 | `wireguardPort` | integer | UDP port the local WireGuard interface binds to. Range `1–65535`. |
 | `allowServerSSH` | boolean | Allow the embedded NetBird SSH server on this peer. |
 | `disableAutoConnect` | boolean | Skip auto-connecting on startup; require an explicit `netbird up`. |
+| `disableAutostart` | boolean | Prevent the GUI from registering itself as an OS autostart entry on fresh installs, and — when enabled at any later point — remove an existing registration on the next GUI launch (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`). Desktop GUIs only; no-op on iOS/Android. Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings. |
 | `rosenpassEnabled` | boolean | Turn on the post-quantum Rosenpass key exchange. |
 | `rosenpassPermissive` | boolean | Permissive mode for Rosenpass (interop with non-Rosenpass peers). |
 | `blockInbound` | boolean | Drop all inbound traffic except established/related — kill-switch style. |
@@ -96,6 +97,11 @@ PascalCase variant in the Group Policy Editor — both are recognized.
   `VpnService.Builder.addAllowedApplication()` flow; on Windows and
   macOS the daemon parses the keys but ignores them. They are safe to
   ship in a cross-platform payload.
+- `disableAutostart` only affects the desktop GUI's OS autostart entry
+  (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`).
+  iOS and Android have no equivalent user-space autostart mechanism —
+  the daemon runs as a system service — so the key is parsed and
+  ignored there. Safe to ship in cross-platform payloads.
 - The `disableMetricsCollection` key is reserved for an upcoming
   metrics integration; the client recognizes it today but no metrics
   pipeline is shipped yet.