feat: DevDesk v0.1.0, a persistent browser terminal for Claude Code

ttyd serves a single-file xterm.js UI styled with the LotusGuild TDS
(web_template base.css). Sessions live in a dedicated tmux server unit
(devdesk-tmux.service), so restarting or upgrading the web unit never
stops Claude. Each named session maps to a project directory. A Claude
SessionStart hook records the conversation ID, so after a reboot the
session resumes that exact conversation.

- bin/devdesk: attach / new / ls / end / pick, with an fzf picker
- ttyd requires a credential that NPM injects; origin check enabled
- debian/: dh 13 with --no-stop-on-upgrade for the tmux unit, bundled
  sha256-verified ttyd 1.7.7, lintian overrides, man page
- CI: lint, test, build, smoke-test, artifact; v* tags publish to the
  Gitea apt registry and create a release

Refs: tinker ticket 887531976

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/npm-advanced.conf

@@ -0,0 +1,35 @@
+# Nginx Proxy Manager → Proxy Host dev.lotusguild.org → Advanced tab.
+# Target: http://10.10.10.58:7681, Websockets Support ON, wildcard *.lotusguild.org cert, Force SSL.
+#
+# Replace __DEVDESK_BASIC__ with the base64 of the credential in /etc/devdesk/secret.env:
+#   . /etc/devdesk/secret.env && printf '%s' "$DEVDESK_CREDENTIAL" | base64 -w0
+# ttyd rejects (401) every request that does not carry it, so only traffic that
+# passed Authelia here can reach the terminal.
+
+include /snippets/authelia-location.conf;
+
+location / {
+    add_header Strict-Transport-Security $hsts_header always;
+
+    auth_request /authelia;
+    auth_request_set $user $upstream_http_remote_user;
+    auth_request_set $groups $upstream_http_remote_groups;
+    auth_request_set $name $upstream_http_remote_name;
+    auth_request_set $email $upstream_http_remote_email;
+
+    proxy_set_header Remote-User $user;
+    proxy_set_header Remote-Groups $groups;
+    proxy_set_header Remote-Name $name;
+    proxy_set_header Remote-Email $email;
+
+    error_page 401 =302 https://auth.lotusguild.org/?rd=$scheme://$http_host$request_uri;
+
+    proxy_set_header Authorization "Basic __DEVDESK_BASIC__";
+
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_http_version 1.1;
+    proxy_buffering off;
+
+    include /etc/nginx/conf.d/include/proxy.conf;
+}