feat(desktop): Tauri v2 kiosk shell — maximized window, prod right-click block, auto-update + code-signing

Add apps/desktop, a thin Tauri v2 shell wrapping the SAME @parking/web SPA so
the desktop and browser UIs never drift: dev loads the Vite dev server (HMR),
prod bundles the web app's dist/. No business logic in the shell (device/auth/
ledger stay in @parking/server); deny-by-default capabilities.

apps/web (single UI source of truth):
- lib/origin.ts: centralize the backend origin (API_BASE/apiUrl/wsUrl from
  VITE_API_BASE); no-op in the browser, lets the desktop build target Fastify.
- lib/kiosk.ts: block the right-click context menu in PROD only (dev keeps it +
  devtools).
- lib/desktop-updater.ts: prompt-on-update auto-update (no-op in browser/offline)
  → downloadAndInstall + relaunch; i18n update.* keys (sq+en).
- .env.production: VITE_API_BASE wired to the Fastify origin for the bundle.

Desktop:
- window starts maximized (not fullscreen — operator keeps OS access).
- auto-update via tauri-plugin-updater + -process; self-hosted endpoint is a
  PLACEHOLDER to fill in. Updater keypair: pubkey embedded in tauri.conf.json;
  private key + password kept OUTSIDE the repo (~/.parking-updater-keys) and as
  TAURI_SIGNING_* build secrets.
- Turbo build is a no-op; the real signed bundle is `pnpm --filter
  @parking/desktop bundle` (verified → .deb/.rpm/.AppImage + .sig signatures).

Verified: cargo check clean; turbo run build lint 14/14 green; i18n parity holds;
no key/sig/bundle artifacts in the repo.

Wiki (security + desktop analysis recorded alongside):
- new concepts/tpm.md (TPM 2.0: how it works, sealed-LUKS auto-unlock + non-
  extractable signing key, limits — live-root, bus-sniff — TPM-vs-ATECC608 by
  platform).
- new decisions/desktop-shell-tauri.md (Tauri v2 over Electron; best-case Ubuntu
  26.04 LTS, worst-case Windows+WSL → kiosk browser; full as-built).
- pull-the-disk attack trace on append-only-event-chain; ATECC608 not-in-a-PC
  caveat; cross-links from disk-os-hardening / threat-model.
- open-questions #11 (appliance WebKitGTK), #12 (TPM hardening impl), #13
  (startup verifyChain self-check); index/overview/log/standing-decisions.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/decisions/open-questions.md

@@ -2,14 +2,14 @@
 type: decision
 tags: [parking, decisions, open]
 sources: [parking-system-architecture]
-updated: 2026-06-15
+updated: 2026-06-21
 status: open
 ---
 
 # Open Questions / Next Steps
 
-**Not yet decided**, and they drive everything else — settle before procurement. (See
-[[parking-system-architecture]] §10.)
+**Not yet decided** (or decided-but-not-yet-built), and they drive everything else — settle before
+procurement. (See [[parking-system-architecture]] §10.)
 
 1. **Lane topology.** One host per lane, or one central host driving networked devices in each
    lane? Decides how many controllers, printers, UPSs, and [[sqlite]] instances exist, and the
@@ -62,3 +62,36 @@ status: open
     reclaim deleted-blob pages without `VACUUM`. **Undecided:** pruning policy (age-based vs.
     total-size cap), VACUUM cadence, and how this interacts with the #5 backup strategy (blobs
     bloat every backup). Until decided, snapshots accumulate unbounded. See [[entry-exit-points]].
+11. **Appliance OS image → WebKitGTK version (Tauri dependency).** _(Raised by
+    [[desktop-shell-tauri]], 2026-06-21; narrowed same day.)_ The chosen
+    [[desktop-shell-tauri|Tauri v2 desktop shell]] renders through the **host's WebKitGTK**, not a
+    bundled browser. The risk reduces to which OS the appliance runs:
+    - **Best case — Ubuntu 26.04 LTS desktop (intended):** ships a current, distro-maintained
+      WebKitGTK → this question is **effectively resolved**; just confirm the built SPA renders on
+      the actual image and pin it.
+    - **Worst case — Windows 11 + WSL + Docker:** this **conflicts with the standing platform
+      decision** (Linux appliance, *not* Windows/WSL — see [[standing-decisions]],
+      [[disk-os-hardening]]) and a GUI shell doesn't live inside headless WSL/Docker. Fallback is
+      **no native shell — a kiosk browser** at the local [[fastify]]-served SPA (Electron only if a
+      standalone Windows installer is mandated). See [[desktop-shell-tauri]] for the decision table.
+    Close this once the appliance OS image is fixed and the SPA is verified against its WebView.
+    (Ties to #1 lane topology / image standardization.)
+12. **TPM 2.0 hardening — implementation (to build).** _(Recorded 2026-06-21; analysis in [[tpm]].)_
+    On the Ubuntu 26.04 LTS appliance, harden using the host **TPM**: (a) **sealed-LUKS auto-unlock**
+    (`systemd-cryptenroll --tpm2-device`) so the encrypted disk auto-unlocks only on an untampered
+    boot → unattended reboot after power loss; (b) optionally hold the **non-extractable host
+    event-signing key** in the TPM (a new `Signer` impl — no `EventLog` change; mirrors the
+    [[atecc608]] swap), defeating the offline pull-the-disk-and-re-sign attack. **Must include:**
+    require **TPM 2.0** (reject 1.2), **prefer fTPM** + a per-op **PIN/auth policy** (not PCR-only —
+    bus-sniff), a **LUKS recovery passphrase**, and a **re-seal-on-update runbook** (kernel/GRUB/BIOS
+    updates change the PCRs and lock the disk). TPM **complements, never replaces**, [[reconciliation]];
+    it does nothing against a rooted live host or the operator. Moot in the Windows + WSL fallback. See
+    [[tpm]], [[disk-os-hardening]]; relates to #6 (host secure-element by platform) and #13.
+13. **Startup chain-integrity self-check (to build).** _(Raised by the pull-the-disk trace,
+    2026-06-21.)_ `verifyChain()` exists and pinpoints any tamper, but **nothing invokes it on
+    boot** — a tampered DB loads and serves normally (detectable but undetected). Wire a **startup
+    self-check** that runs `verifyChain()` and, on a break, **flags degraded state / writes a signed
+    `anomaly` + alarms** (surfaced to the booth footer / next reconciliation). Open: refuse-to-serve
+    vs. serve-degraded — lean **serve-degraded + loud alarm** (fail-open on exit still governs;
+    refusing to boot could strand a lane). Software-only, independent of the TPM/[[atecc608]] hardware.
+    See [[append-only-event-chain]].