Deploy rearchitected MusicMouse backend + web frontend

The app grew a python-backend/ and a web/ frontend, so pi_musicmouse no
longer matches it. Rework the role:

- Install a pinned uv and build the venv with Python 3.13; Raspbian
  Bookworm's python3 is 3.11 and the backend uses PEP 695 syntax.
- pip install python-backend/ instead of a requirements.txt, and take
  the systemd unit straight from the checkout so it can't drift.
- Build web/ on the control machine (no npm on the Pi) and rsync
  web/dist over. Chain the checkout -> install -> build -> sync -> restart
  steps through handlers so a run with no repo change does nothing.
- Per-host config files (config-<host>.yml); the schema now differs
  between a host with a real mouse and a display-only one.
- Version to deploy is per host (musicmouse_version), no default.

Add pi_kiosk: autologin user running startx with Firefox in kiosk mode
and no window manager, for a Pi with a monitor attached. Enabled by
mediapi_has_monitor, defaulting off.

Turn musicdolphin into a display-only instance: serial and audio
simulated, driven entirely through the kiosk page.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

roles/pi_kiosk/README.md

@@ -0,0 +1,18 @@
+# pi_kiosk
+
+Turns a Pi with a monitor attached into a full-screen Firefox kiosk display, with no
+window manager: an autologin console user runs `startx`, whose `.xinitrc` launches
+Firefox in `--kiosk` mode pointed at `pi_kiosk_url` and relaunches it if it ever exits.
+If X itself crashes, `.bash_profile` restarts it.
+
+Vars:
+
+- `pi_kiosk_user` (default `kiosk`) - the account that autologs into tty1.
+- `pi_kiosk_url` (default `http://localhost:8080`) - what Firefox shows.
+
+Meant to run alongside `pi_musicmouse` on the same host when it's serving the page
+locally (the default `pi_kiosk_url`), gated in `mediapis.yml` by `mediapi_has_monitor`.
+
+niri was considered instead of plain X/no-WM, but isn't packaged for Debian Bookworm
+yet (no official apt package, only third-party `.deb`s or a from-source Rust build) -
+revisit once it is.