terminal: add multi-tmux-session lobby on term.viktorbarzin.me (additive)

New hostname term.viktorbarzin.me serves a session-picker UI that lists,
creates, and kills tmux sessions. Visiting ?arg=<name> attaches to that
session (auto-creates via tmux -A). Builds on a fresh ttyd instance
(7685) plus a tmux-api Go binary (7684) on the DevVM, both running as
User=wizard alongside (not replacing) the existing ttyd.service (7681),
ttyd-ro.service (7682), and clipboard-upload (7683). Cutover of
terminal.viktorbarzin.me to the multi-session setup is deferred.

Terraform diff is purely additive — terminal-multi/tmux-api Service +
Endpoints + ingress_multi (term.viktorbarzin.me, Authentik-gated) + an
IngressRoute that path-prefixes /api/sessions/* to tmux-api with the
matching strip-prefix Middleware.

DevVM-side units ship under files/devvm/ with a README — manual scp +
systemctl install (see files/devvm/README.md). ttyd 1.7.7 already
deployed there (≥1.7 needed for -a).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

stacks/terminal/files/devvm/tmux-attach.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Invoked by ttyd-multi.service. ttyd's -a flag forwards ?arg=<value> as $1.
+# Defence-in-depth: ttyd uses argv (never shell strings) and we re-validate
+# here before handing the name to tmux as a quoted argv slot.
+set -euo pipefail
+
+name="${1:-main}"
+if ! [[ "$name" =~ ^[a-zA-Z0-9_-]{1,32}$ ]]; then
+    name=main
+fi
+
+exec tmux new-session -A -s "$name" -c /home/wizard/code