dsh-remote 0.1.0: master/slave remote control for DSH

- authenticated WebSocket link (dependency-free RFC6455 + stream mux), pairing
  codes, per-device keys (hashed), revoke/remove
- /r/<device>/ proxy of the full DSH UI (HTTP, Remote WebSocket, SSE) with
  per-device cookie minting; slave->slave relay through the master
- Devices sidebar panel (all devices' sessions, new session on device),
  Remote devices settings page, finished-session toasts
- plugin + config sync master->slave: registry bundles via pluginManager,
  link: plugins as tarballs, cordis.patch.yml into a managed bundle layer
  (!!js preserved), allow/deny, opt-in per-secret credential sync
- deploy helpers + e2e probes, unit tests

cordis.patch.yml

@@ -0,0 +1,25 @@
+- insert:
+    - id: dsh-remote
+      name: '@local/dsh-remote'
+      config:
+        # master | slave | auto (auto = slave once paired with a master, else master)
+        role: auto
+        # Display name of this device (defaults to the hostname); its id is the slug of it.
+        deviceName: ''
+        # Shown in the Devices page so other machines know where to pair.
+        lanUrl: ''
+        publicUrl: ''
+        sync:
+          # slave: pull plugins/config automatically on link-up and when the master pushes.
+          auto: true
+          # slave: bundle allow/deny lists (exact names or prefix*). deny wins.
+          allow: []
+          deny: []
+          # slave: names of credential refs to accept from the master (opt-in, per secret).
+          secrets: []
+          # master: credential refs offered to devices (each device still opts in on the master
+          # Devices page AND locally via `secrets` above).
+          offerSecrets: []
+          # master: never sync these bundles / cordis.patch.yml entry ids.
+          excludeBundles: []
+          excludePatchIds: []