feat: DevDesk v0.1.0, a persistent browser terminal for Claude Code

ttyd serves a single-file xterm.js UI styled with the LotusGuild TDS
(web_template base.css). Sessions live in a dedicated tmux server unit
(devdesk-tmux.service), so restarting or upgrading the web unit never
stops Claude. Each named session maps to a project directory. A Claude
SessionStart hook records the conversation ID, so after a reboot the
session resumes that exact conversation.

- bin/devdesk: attach / new / ls / end / pick, with an fzf picker
- ttyd requires a credential that NPM injects; origin check enabled
- debian/: dh 13 with --no-stop-on-upgrade for the tmux unit, bundled
  sha256-verified ttyd 1.7.7, lintian overrides, man page
- CI: lint, test, build, smoke-test, artifact; v* tags publish to the
  Gitea apt registry and create a release

Refs: tinker ticket 887531976

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libexec/devdesk-serve

@@ -0,0 +1,25 @@
+#!/bin/bash
+# ExecStart for devdesk.service: builds the ttyd command line from
+# /etc/devdesk/env and /etc/devdesk/secret.env (loaded by systemd).
+set -euo pipefail
+
+if [ -z "${DEVDESK_CREDENTIAL:-}" ]; then
+    echo "devdesk-serve: DEVDESK_CREDENTIAL is not set (expected in /etc/devdesk/secret.env)" >&2
+    exit 1
+fi
+
+args=(
+    --port "${DEVDESK_PORT:-7681}"
+    --writable                          # ttyd >= 1.7.4 is read-only by default
+    --url-arg                           # ?arg=<session> becomes `devdesk attach <session>`
+    --check-origin                      # refuse cross-site WebSocket connections
+    --max-clients "${DEVDESK_MAX_CLIENTS:-8}"
+    --credential "$DEVDESK_CREDENTIAL"  # injected by NPM as an Authorization header
+    --index "${DEVDESK_INDEX:-/usr/share/devdesk/index.html}"
+    --debug "${DEVDESK_TTYD_LOG_LEVEL:-3}" # errors+warnings only: notice level would log the credential
+)
+if [ -n "${DEVDESK_BIND:-}" ]; then
+    args+=(--interface "$DEVDESK_BIND")
+fi
+
+exec "${DEVDESK_TTYD:-/usr/lib/devdesk/bin/ttyd}" "${args[@]}" "${DEVDESK_BIN:-/usr/bin/devdesk}" attach