terminal: add multi-tmux-session lobby on term.viktorbarzin.me (additive)

New hostname term.viktorbarzin.me serves a session-picker UI that lists,
creates, and kills tmux sessions. Visiting ?arg=<name> attaches to that
session (auto-creates via tmux -A). Builds on a fresh ttyd instance
(7685) plus a tmux-api Go binary (7684) on the DevVM, both running as
User=wizard alongside (not replacing) the existing ttyd.service (7681),
ttyd-ro.service (7682), and clipboard-upload (7683). Cutover of
terminal.viktorbarzin.me to the multi-session setup is deferred.

Terraform diff is purely additive — terminal-multi/tmux-api Service +
Endpoints + ingress_multi (term.viktorbarzin.me, Authentik-gated) + an
IngressRoute that path-prefixes /api/sessions/* to tmux-api with the
matching strip-prefix Middleware.

DevVM-side units ship under files/devvm/ with a README — manual scp +
systemctl install (see files/devvm/README.md). ttyd 1.7.7 already
deployed there (≥1.7 needed for -a).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

stacks/terminal/main.tf

@@ -216,3 +216,158 @@ module "ingress_ro" {
     "gethomepage.dev/pod-selector" = ""
   }
 }
+
+# === Multi-session terminal: term.viktorbarzin.me ===
+#
+# Additive lobby UX on a fresh hostname + ports — does not touch the existing
+# terminal.viktorbarzin.me (7681), terminal-ro.viktorbarzin.me (7682) or
+# /clipboard/* (7683) wiring above. DevVM-side units (ttyd-multi.service on
+# port 7685, tmux-api.service on port 7684) ship from
+# files/devvm/ — see files/devvm/README.md.
+
+# Service+Endpoints → ttyd-multi on the DevVM (port 7685).
+resource "kubernetes_service" "terminal_multi" {
+  metadata {
+    name      = "terminal-multi"
+    namespace = kubernetes_namespace.terminal.metadata[0].name
+    labels = {
+      app = "terminal-multi"
+    }
+  }
+
+  spec {
+    port {
+      name        = "http"
+      port        = 80
+      target_port = 7685
+    }
+  }
+}
+
+resource "kubernetes_endpoints" "terminal_multi" {
+  metadata {
+    name      = "terminal-multi"
+    namespace = kubernetes_namespace.terminal.metadata[0].name
+  }
+
+  subset {
+    address {
+      ip = "10.0.10.10"
+    }
+    port {
+      name = "http"
+      port = 7685
+    }
+  }
+}
+
+# Service+Endpoints → tmux-api on the DevVM (port 7684).
+resource "kubernetes_service" "tmux_api" {
+  metadata {
+    name      = "tmux-api"
+    namespace = kubernetes_namespace.terminal.metadata[0].name
+    labels = {
+      app = "tmux-api"
+    }
+  }
+
+  spec {
+    port {
+      name        = "http"
+      port        = 80
+      target_port = 7684
+    }
+  }
+}
+
+resource "kubernetes_endpoints" "tmux_api" {
+  metadata {
+    name      = "tmux-api"
+    namespace = kubernetes_namespace.terminal.metadata[0].name
+  }
+
+  subset {
+    address {
+      ip = "10.0.10.10"
+    }
+    port {
+      name = "http"
+      port = 7684
+    }
+  }
+}
+
+# Public ingress for the lobby + per-session attach.
+# Hostname: term.viktorbarzin.me (via `host = "term"` override).
+module "ingress_multi" {
+  source          = "../../modules/kubernetes/ingress_factory"
+  dns_type        = "proxied"
+  namespace       = kubernetes_namespace.terminal.metadata[0].name
+  name            = "terminal-multi"
+  host            = "term"
+  tls_secret_name = var.tls_secret_name
+  auth            = "required"
+  extra_annotations = {
+    "gethomepage.dev/enabled"      = "true"
+    "gethomepage.dev/name"         = "Terminal (Multi)"
+    "gethomepage.dev/description"  = "Multi-session tmux lobby (ttyd)"
+    "gethomepage.dev/icon"         = "mdi-console"
+    "gethomepage.dev/group"        = "Infrastructure"
+    "gethomepage.dev/pod-selector" = ""
+  }
+}
+
+# IngressRoute: /api/sessions/* on term.viktorbarzin.me → tmux-api service.
+# Path-prefixed routes beat the catch-all module ingress above by
+# specificity, so the lobby HTML reaches tmux-api directly while everything
+# else flows to ttyd-multi.
+resource "kubernetes_manifest" "tmux_api_ingressroute" {
+  manifest = {
+    apiVersion = "traefik.io/v1alpha1"
+    kind       = "IngressRoute"
+    metadata = {
+      name      = "tmux-api"
+      namespace = kubernetes_namespace.terminal.metadata[0].name
+    }
+    spec = {
+      entryPoints = ["websecure"]
+      routes = [{
+        match = "Host(`term.viktorbarzin.me`) && PathPrefix(`/api/sessions/`)"
+        kind  = "Rule"
+        middlewares = [
+          {
+            name      = "authentik-forward-auth"
+            namespace = "traefik"
+          },
+          {
+            name      = "tmux-api-strip-prefix"
+            namespace = kubernetes_namespace.terminal.metadata[0].name
+          }
+        ]
+        services = [{
+          name = "tmux-api"
+          port = 80
+        }]
+      }]
+      tls = {
+        secretName = var.tls_secret_name
+      }
+    }
+  }
+}
+
+resource "kubernetes_manifest" "tmux_api_strip_prefix" {
+  manifest = {
+    apiVersion = "traefik.io/v1alpha1"
+    kind       = "Middleware"
+    metadata = {
+      name      = "tmux-api-strip-prefix"
+      namespace = kubernetes_namespace.terminal.metadata[0].name
+    }
+    spec = {
+      stripPrefix = {
+        prefixes = ["/api/sessions"]
+      }
+    }
+  }
+}