feat(kiosk): self-recover a hung wall and page when it goes quiet

An unattended wall failed in two ways on 2026-11-02. It hard-hung with the kernel
alive but userspace unable to start a process: ssh completed the handshake and
closed 6-13 ms later with zero bytes and no banner, while 62 GiB RAM and zero OOM
lines rule out memory. Separately, the service knew at 14:03Z that nothing was
watching (healthz viewers:0) and nothing was reading it. It was discovered by
walking over to the panel.

Hang recovery, two independent layers (install step 7/9, asserted by
check-kiosk.sh):

- /etc/sysctl.d/90-mirror-wall-selfheal.conf: soft lockup, hard lockup and any
  oops escalate to a panic, and kernel.panic=30 reboots instead of parking.
- /etc/systemd/system.conf.d/90-mirror-wall-watchdog.conf: PID 1 must keep kicking
  the iTCO hardware watchdog or the chipset resets the box, which is the layer that
  covers a kernel too wedged to notice. Clamped to the driver's own 30s because
  systemd kicks at a third of whatever value it is handed.

Presence alerting: docs/wall-watch/ runs on the server host, probes loopback
/healthz (exempt from the address gate) every minute, debounces three checks, pages
over ntfy and then announces the recovery. WALL_DRILL=1 labels a test page in the
title, body and priority so a drill can never be mistaken for an incident.
Verified against a fake ntfy: caller environment wins over the config file, both
transitions fire, and the debounce holds.

Firewall (install step 8/9): drop FedoraWorkstation's 1025-65535/tcp. The UDP half
is load-bearing for peer-to-peer media (mirror deliberately uses no STUN/TURN) and
stays open; the TCP half was every high port on a box whose only access control is
its address. Measured, not assumed: a live share kept flowing at 459.6 kbit/s
inbound with the TCP range closed, and tcp/8080 stopped answering from a
same-subnet host.

Also fixed: install-kiosk.sh overwrote an existing client's kiosk.conf with its
built-in default URL, so re-running it to repair a wall silently repointed it at
the production default. An existing URL now wins and KIOSK_URL= is an explicit
change.

Documented with the evidence: why gnome-remote-desktop cannot share a gnome-kiosk
session (gnome-kiosk exports no org.gnome.Mutter.* names, so grd has nothing to
capture, and this image has grdctl rather than grdc), and why no userspace RDP
would have survived the hang either.

LLM-Generated: true

docs/wall-watch/wall-watch.env.example

@@ -0,0 +1,28 @@
+# /etc/mirror-wall-watch.env — config for mirror-wall-watch.timer.
+# chmod 0600, root:root. It holds the ntfy token. Never commit a filled-in copy.
+# install-wall-watch.sh seeds this from the example and then NEVER overwrites it.
+
+# The presence probe. /healthz is exempt from the address gate, so loopback works
+# even when MIRROR_ALLOW_CIDRS excludes 127.0.0.0/8 — which is why the container
+# healthcheck works too. Use whatever loopback URL reaches this deployment.
+WALL_HEALTH_URL=https://127.0.0.1/healthz
+
+# Alert when fewer than this many viewers are attached. Set 0 to stop alerting on
+# "nobody is watching" and only alert when the service itself stops answering
+# (useful while a fleet has no wall plugged in).
+WALL_EXPECT_VIEWERS=1
+
+# Consecutive bad checks before the first notification (~1 min per check). Three
+# rides out a Firefox relaunch on the wall; raise it if that is normal for you.
+WALL_THRESHOLD=3
+
+# Keep shouting while it stays down. 0 = alert once per incident.
+WALL_RENOTIFY_SECS=3600
+
+# Optional: the URL a notification opens when tapped.
+WALL_STATUS_URL=https://mirror.reeseapps.com/healthz
+
+# ntfy (outbound only — this never reads anything back).
+NTFY_URL=https://ntfy.reeseapps.com
+NTFY_TOKEN=
+NTFY_TOPIC=pi