Deploy rearchitected MusicMouse backend + web frontend

The app grew a python-backend/ and a web/ frontend, so pi_musicmouse no
longer matches it. Rework the role:

- Install a pinned uv and build the venv with Python 3.13; Raspbian
  Bookworm's python3 is 3.11 and the backend uses PEP 695 syntax.
- pip install python-backend/ instead of a requirements.txt, and take
  the systemd unit straight from the checkout so it can't drift.
- Build web/ on the control machine (no npm on the Pi) and rsync
  web/dist over. Chain the checkout -> install -> build -> sync -> restart
  steps through handlers so a run with no repo change does nothing.
- Per-host config files (config-<host>.yml); the schema now differs
  between a host with a real mouse and a display-only one.
- Version to deploy is per host (musicmouse_version), no default.

Add pi_kiosk: autologin user running startx with Firefox in kiosk mode
and no window manager, for a Pi with a monitor attached. Enabled by
mediapi_has_monitor, defaulting off.

Turn musicdolphin into a display-only instance: serial and audio
simulated, driven entirely through the kiosk page.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

roles/pi_kiosk/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Packages
+  ansible.builtin.apt:
+    name:
+      - xserver-xorg
+      - xinit
+      - x11-xserver-utils
+      - firefox-esr
+      - unclutter
+    cache_valid_time: 7200
+
+- name: Create kiosk user
+  ansible.builtin.user:
+    name: "{{ pi_kiosk_user }}"
+    groups: [video, input, tty]
+    shell: /bin/bash
+    create_home: true
+
+- name: Autologin the kiosk user on tty1
+  ansible.builtin.file:
+    path: /etc/systemd/system/getty@tty1.service.d
+    state: directory
+    mode: "0755"
+
+- name: Install getty autologin override
+  ansible.builtin.template:
+    src: autologin.conf.j2
+    dest: /etc/systemd/system/getty@tty1.service.d/autologin.conf
+    mode: "0644"
+  notify: Reload systemd and restart getty
+
+- name: Install .bash_profile (starts X on tty1 login)
+  ansible.builtin.template:
+    src: bash_profile.j2
+    dest: "/home/{{ pi_kiosk_user }}/.bash_profile"
+    owner: "{{ pi_kiosk_user }}"
+    group: "{{ pi_kiosk_user }}"
+    mode: "0644"
+
+- name: Install .xinitrc (launches Firefox kiosk, no window manager)
+  ansible.builtin.template:
+    src: xinitrc.j2
+    dest: "/home/{{ pi_kiosk_user }}/.xinitrc"
+    owner: "{{ pi_kiosk_user }}"
+    group: "{{ pi_kiosk_user }}"
+    mode: "0755"
+
+- name: Ensure firefox-esr policy directory exists
+  ansible.builtin.file:
+    path: /etc/firefox-esr
+    state: directory
+    mode: "0755"
+  # apt normally creates this; a backstop in case the package layout doesn't
+
+- name: Install Firefox enterprise policy (suppress session-restore/update prompts)
+  ansible.builtin.copy:
+    src: policies.json
+    dest: /etc/firefox-esr/policies.json
+    mode: "0644"