Deploy rearchitected MusicMouse backend + web frontend

The app grew a python-backend/ and a web/ frontend, so pi_musicmouse no
longer matches it. Rework the role:

- Install a pinned uv and build the venv with Python 3.13; Raspbian
  Bookworm's python3 is 3.11 and the backend uses PEP 695 syntax.
- pip install python-backend/ instead of a requirements.txt, and take
  the systemd unit straight from the checkout so it can't drift.
- Build web/ on the control machine (no npm on the Pi) and rsync
  web/dist over. Chain the checkout -> install -> build -> sync -> restart
  steps through handlers so a run with no repo change does nothing.
- Per-host config files (config-<host>.yml); the schema now differs
  between a host with a real mouse and a display-only one.
- Version to deploy is per host (musicmouse_version), no default.

Add pi_kiosk: autologin user running startx with Firefox in kiosk mode
and no window manager, for a Pi with a monitor attached. Enabled by
mediapi_has_monitor, defaulting off.

Turn musicdolphin into a display-only instance: serial and audio
simulated, driven entirely through the kiosk page.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

roles/pi_kiosk/README.md

@@ -0,0 +1,18 @@
+# pi_kiosk
+
+Turns a Pi with a monitor attached into a full-screen Firefox kiosk display, with no
+window manager: an autologin console user runs `startx`, whose `.xinitrc` launches
+Firefox in `--kiosk` mode pointed at `pi_kiosk_url` and relaunches it if it ever exits.
+If X itself crashes, `.bash_profile` restarts it.
+
+Vars:
+
+- `pi_kiosk_user` (default `kiosk`) - the account that autologs into tty1.
+- `pi_kiosk_url` (default `http://localhost:8080`) - what Firefox shows.
+
+Meant to run alongside `pi_musicmouse` on the same host when it's serving the page
+locally (the default `pi_kiosk_url`), gated in `mediapis.yml` by `mediapi_has_monitor`.
+
+niri was considered instead of plain X/no-WM, but isn't packaged for Debian Bookworm
+yet (no official apt package, only third-party `.deb`s or a from-source Rust build) -
+revisit once it is.

roles/pi_kiosk/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+pi_kiosk_user: "kiosk"
+pi_kiosk_url: "http://localhost:8080"

roles/pi_kiosk/files/policies.json

@@ -0,0 +1,29 @@
+{
+  "policies": {
+    "DisableAppUpdate": true,
+    "DisableFirefoxStudies": true,
+    "DisableProfileImport": true,
+    "DisableTelemetry": true,
+    "DontCheckDefaultBrowser": true,
+    "NoDefaultBookmarks": true,
+    "OverrideFirstRunPage": "",
+    "OverridePostUpdatePage": "",
+    "PasswordManagerEnabled": false,
+    "UserMessaging": {
+      "WhatsNew": false,
+      "ExtensionRecommendations": false,
+      "FeatureRecommendations": false,
+      "Locked": true
+    },
+    "Preferences": {
+      "browser.sessionstore.resume_from_crash": {
+        "Value": false,
+        "Status": "locked"
+      },
+      "browser.tabs.warnOnClose": {
+        "Value": false,
+        "Status": "locked"
+      }
+    }
+  }
+}

roles/pi_kiosk/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Reload systemd and restart getty
+  ansible.builtin.systemd:
+    name: "getty@tty1"
+    state: restarted
+    daemon_reload: "yes"

roles/pi_kiosk/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Packages
+  ansible.builtin.apt:
+    name:
+      - xserver-xorg
+      - xinit
+      - x11-xserver-utils
+      - firefox-esr
+      - unclutter
+    cache_valid_time: 7200
+
+- name: Create kiosk user
+  ansible.builtin.user:
+    name: "{{ pi_kiosk_user }}"
+    groups: [video, input, tty]
+    shell: /bin/bash
+    create_home: true
+
+- name: Autologin the kiosk user on tty1
+  ansible.builtin.file:
+    path: /etc/systemd/system/getty@tty1.service.d
+    state: directory
+    mode: "0755"
+
+- name: Install getty autologin override
+  ansible.builtin.template:
+    src: autologin.conf.j2
+    dest: /etc/systemd/system/getty@tty1.service.d/autologin.conf
+    mode: "0644"
+  notify: Reload systemd and restart getty
+
+- name: Install .bash_profile (starts X on tty1 login)
+  ansible.builtin.template:
+    src: bash_profile.j2
+    dest: "/home/{{ pi_kiosk_user }}/.bash_profile"
+    owner: "{{ pi_kiosk_user }}"
+    group: "{{ pi_kiosk_user }}"
+    mode: "0644"
+
+- name: Install .xinitrc (launches Firefox kiosk, no window manager)
+  ansible.builtin.template:
+    src: xinitrc.j2
+    dest: "/home/{{ pi_kiosk_user }}/.xinitrc"
+    owner: "{{ pi_kiosk_user }}"
+    group: "{{ pi_kiosk_user }}"
+    mode: "0755"
+
+- name: Ensure firefox-esr policy directory exists
+  ansible.builtin.file:
+    path: /etc/firefox-esr
+    state: directory
+    mode: "0755"
+  # apt normally creates this; a backstop in case the package layout doesn't
+
+- name: Install Firefox enterprise policy (suppress session-restore/update prompts)
+  ansible.builtin.copy:
+    src: policies.json
+    dest: /etc/firefox-esr/policies.json
+    mode: "0644"

roles/pi_kiosk/templates/autologin.conf.j2

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty --autologin {{ pi_kiosk_user }} --noclear %I $TERM

roles/pi_kiosk/templates/bash_profile.j2

@@ -0,0 +1,8 @@
+# Managed by ansible (pi_kiosk role). Auto-starts the kiosk browser on the console
+# this account autologs into - not meant for interactive use.
+if [ -z "$DISPLAY" ] && [ "$(tty)" = "/dev/tty1" ]; then
+  while true; do
+    startx -- -nocursor
+    sleep 1
+  done
+fi

roles/pi_kiosk/templates/xinitrc.j2

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Managed by ansible (pi_kiosk role). No window manager on purpose - Firefox is the
+# only X client, launched full-screen in kiosk mode; the loop is what takes the place
+# of a WM's "keep something on screen" job if it crashes.
+
+xset s off
+xset -dpms
+xset s noblank
+
+unclutter -idle 0.5 -root &
+
+while true; do
+  firefox --kiosk "{{ pi_kiosk_url }}"
+  sleep 2
+done