tinyagentos.com: remote desktop proxy at desktop.tinyagentos.com (phase 5)

[jaylfc]

Single public URL — desktop.tinyagentos.com — that routes each authenticated web session to that user's linked TAOS controller over the Headscale mesh. The proxy is a thin Go service that: (1) terminates TLS at Caddy, (2) validates the incoming Kratos session cookie via GET /sessions/whoami, (3) looks up the account's bound controller node and its mesh IP in the orchestrator's devices table, and (4) forwards the WebSocket connection to <mesh-ip>:7070 using the platform-admin Headscale identity.

The proxy supports switching between multiple linked controllers via a statusbar dropdown rendered client-side. The dropdown is populated from the orchestrator's /api/v1/devices endpoint, filtered to the authenticated account. Switching sends a new routing hint in the session; the proxy re-targets the WebSocket without a full page reload.

The proxy itself carries no session state — it is stateless and can be restarted without dropping in-flight connections (WebSocket hijacking hands off to the forwarded connection). TLS termination is Caddy's responsibility; the proxy listens on a Unix socket behind Caddy.

Acceptance criteria:

• desktop.tinyagentos.com requires a valid Kratos session; unauthenticated requests redirect to /login
• Authenticated session routes to the correct controller's <mesh-ip>:7070 for that account
• Cross-account routing is impossible: session identity checked against device ownership before forwarding
• WebSocket connections survive a proxy process restart within the Caddy keepalive window
• Controller switcher dropdown populates from live orchestrator data, not a stale client cache
• Proxy runs as a systemd service on the platform LXC, behind the Caddy Unix socket
• End-to-end test: login → link → open desktop URL → TAOS UI loads from controller

Depends on: #95, #96