ops: ttyd web terminal sidecar behind nginx auth_request

- tmux-web-attach.sh: attach browser to one window via link-window into a
  private temp session (no session-group pollution); window-size smallest
  while attached so the browser never gets cut off; mouse on for natural
  wheel/touch scrolling; status bar off; destroy-unattached cleanup
- start-ttyd.sh: ttyd on 127.0.0.1:7681, base path /term, url-arg enabled,
  Tokyo Night theme, system mono stack, fontSize 14
- systemd user unit + install script registration
- nginx: /term/ proxied with websocket upgrade, gated by auth_request to
  the kanban cookie check; unauthenticated -> 302 /login

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/nginx.user-8443.conf

@@ -45,6 +45,31 @@ http {
             proxy_set_header X-Forwarded-Proto https;
         }
 
+        location = /api/auth/check {
+            internal;
+            proxy_pass http://127.0.0.1:5180;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header X-Forwarded-Proto https;
+        }
+
+        location /term/ {
+            auth_request /api/auth/check;
+            error_page 401 = @term_login;
+            proxy_pass http://127.0.0.1:7681;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_read_timeout 6h;
+            proxy_send_timeout 6h;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Proto https;
+        }
+
+        location @term_login {
+            return 302 /login;
+        }
+
         location / {
             proxy_pass http://127.0.0.1:5180;
             proxy_http_version 1.1;