dsh-remote 0.1.0: master/slave remote control for DSH

- authenticated WebSocket link (dependency-free RFC6455 + stream mux), pairing
  codes, per-device keys (hashed), revoke/remove
- /r/<device>/ proxy of the full DSH UI (HTTP, Remote WebSocket, SSE) with
  per-device cookie minting; slave->slave relay through the master
- Devices sidebar panel (all devices' sessions, new session on device),
  Remote devices settings page, finished-session toasts
- plugin + config sync master->slave: registry bundles via pluginManager,
  link: plugins as tarballs, cordis.patch.yml into a managed bundle layer
  (!!js preserved), allow/deny, opt-in per-secret credential sync
- deploy helpers + e2e probes, unit tests

deploy/dsh-web.user.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=DeepSeek Harness (dsh web) for this user on 127.0.0.1:3081
+After=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=%h
+Environment=NODE_ENV=production
+Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+ExecStart=%h/.local/bin/dsh web --host 127.0.0.1 --port 3081 --no-open
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target