ops: ttyd web terminal sidecar behind nginx auth_request

- tmux-web-attach.sh: attach browser to one window via link-window into a
  private temp session (no session-group pollution); window-size smallest
  while attached so the browser never gets cut off; mouse on for natural
  wheel/touch scrolling; status bar off; destroy-unattached cleanup
- start-ttyd.sh: ttyd on 127.0.0.1:7681, base path /term, url-arg enabled,
  Tokyo Night theme, system mono stack, fontSize 14
- systemd user unit + install script registration
- nginx: /term/ proxied with websocket upgrade, gated by auth_request to
  the kanban cookie check; unauthenticated -> 302 /login

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/systemd/local-kanban-ttyd.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Local Kanban ttyd web terminal (tmux attach)
+After=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/gahow/projects/kanban
+ExecStart=/home/gahow/projects/kanban/scripts/start-ttyd.sh
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=default.target