ops: ttyd web terminal sidecar behind nginx auth_request

- tmux-web-attach.sh: attach browser to one window via link-window into a
  private temp session (no session-group pollution); window-size smallest
  while attached so the browser never gets cut off; mouse on for natural
  wheel/touch scrolling; status bar off; destroy-unattached cleanup
- start-ttyd.sh: ttyd on 127.0.0.1:7681, base path /term, url-arg enabled,
  Tokyo Night theme, system mono stack, fontSize 14
- systemd user unit + install script registration
- nginx: /term/ proxied with websocket upgrade, gated by auth_request to
  the kanban cookie check; unauthenticated -> 302 /login

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/start-ttyd.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# ttyd web terminal for tmux attach.
+# Theme: Tokyo Night; font: system monospace stack (fonts render client-side,
+# so we rely on whatever mono font the viewing device ships).
+# xterm.js client options: https://xtermjs.org/docs/api/terminal/interfaces/iterminaloptions/
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+exec /usr/bin/ttyd \
+  -p 7681 \
+  -i 127.0.0.1 \
+  -W \
+  -a \
+  -b /term \
+  -T xterm-256color \
+  -t titleFixed='Kanban Terminal' \
+  -t fontSize=14 \
+  -t lineHeight=1.2 \
+  -t 'fontFamily=ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace' \
+  -t cursorBlink=true \
+  -t 'theme={"background":"#1a1b26","foreground":"#c0caf5","cursor":"#c0caf5","cursorAccent":"#1a1b26","selectionBackground":"#283457","black":"#15161e","red":"#f7768e","green":"#9ece6a","yellow":"#e0af68","blue":"#7aa2f7","magenta":"#bb9af7","cyan":"#7dcfff","white":"#a9b1d6","brightBlack":"#414868","brightRed":"#f7768e","brightGreen":"#9ece6a","brightYellow":"#e0af68","brightBlue":"#7aa2f7","brightMagenta":"#bb9af7","brightCyan":"#7dcfff","brightWhite":"#c0caf5"}' \
+  "${ROOT_DIR}/scripts/tmux-web-attach.sh"