Open Terminal fleet for all accounts + OpenWebUI UAT pass (#610)

open-terminal 0.11.34 bare-metal (human-authorized host install) with a
systemd template unit: reachableceo on tailscale-only :30000 (cwd
~/projects) and all 8 other accounts on :30001-30008, each with its own
key kept out of ps in per-user TOMLs, all users added to the docker group.
Keys live in ~/.creds + /etc/ukrrs/open-terminal, never in this repo.

UAT: throwaway OpenWebUI v0.11.1 (matched to the human's Cloudron prod)
driven purely over its HTTP API against the beta gateway lane - connection
verify/config PASS, direct exec as uid 1001 PASS, and the chat round trip
PASS: the model emitted run_command, we executed it through OpenWebUI's
terminal proxy (server holds the key), and the final answer named 9/9 real
project directories; earlier negative runs prove the test catches
hallucinated output. Ops note OPEN-TERMINAL.md documents production wiring
(prod openwebui container v0.3.10 is too old and needs an upgrade first).

Also tonight: agent-stack relaunchers removed (6-, backups kept) so no
screen/crush sessions auto-start on reboot; 22:00 night-profile flip
observed live; docs synced for the earlier teardown.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
[#610]

README.md

@@ -22,7 +22,10 @@ are manual-only by ruling.
 - Scripts (human-run unless noted): 1-guest-prep.sh, 2-host-one-shot.sh,
   3-post-reboot-fixes.sh, 4-host-netcheck.sh (crush may run via ssh),
   5-activate-multiqueue.sh (the one remaining reboot), 6-remove-agent-stacks.sh
-  (kill boot-time screen/crush relaunchers); staged/ holds the gated configs
-  those scripts install. removed-agent-stacks/ holds unit/launcher backups
-  from 6-.
+  (boot-time screen/crush relauncher teardown; backups in
+  removed-agent-stacks/), 7-open-terminal-install.sh + 8-open-terminal-users.sh
+  (Open Terminal fleet, #610), 9-uat-openwebui.sh (OpenWebUI<->terminal UAT
+  harness; uat/ holds its compose). staged/ holds the gated configs.
+- OPEN-TERMINAL.md — ops note for the terminal fleet: ports, keys location,
+  production OpenWebUI wiring, UAT record.
 - crush.md = session preferences for agents working in this repo.