docs: the Silverblue kiosk client, installed and checked over SSH

A wall display is now a target client: Fedora Silverblue running GNOME
Kiosk, auto-logged in as kiosk, showing /watch fullscreen in Firefox.
docs/kiosk-silverblue/ carries the idempotent installer, a read-only
checker and a probe that measures what the browser actually renders, so
a second client is a copy-paste and nothing about it needs a keyboard.

The runbook records what the upstream tutorial leaves out: gsettings
only commits from inside the session (gnome-kiosk sets DCONF_PROFILE,
so a system dconf db is never read at all), window-config.ini wins by
being found first and therefore silently loses the shipped notification
rules, AccountsService caches Session= until its daemon restarts, and
/watch survives a bare LAN IP while /mirror cannot.

Verified on the reference client: cold boot back to a subscribed wall in
under 60s, viewport == window == screen at 3840x2160, and the sharer's
own peer connection to it reports connected.

LLM-Generated: true

README.md

@@ -36,6 +36,9 @@ Linux is the primary target. On Linux the native picker is X11/Wayland's own
 (Chromium uses `xdg-desktop-portal` on Wayland/GNOME/KDE, and its built-in X11
 picker on Xorg), so nothing has to be installed on the client side.
 
+The target *client* setup for an always-on display is Fedora Silverblue running
+GNOME Kiosk — see [`docs/kiosk-silverblue.md`](docs/kiosk-silverblue.md).
+
 ## How it works
 
 Media never touches the server. Each mirror is a WebRTC peer connection
@@ -105,6 +108,25 @@ from this side:
   server only relays JSON, so it dials nothing; `Internal=true` is what makes
   that a fact rather than an intention.
 
+### Kiosk client
+
+A wall display is a Fedora Silverblue box running the locked-down GNOME Kiosk
+session, auto-logged in as `kiosk`, with Firefox in `--kiosk` mode pointed at
+`/watch`. It is set up and repaired entirely over SSH — no keyboard, no console,
+no monitor:
+
+```bash
+scp -r docs/kiosk-silverblue client:/tmp/ && ssh client \
+  'cd /tmp/kiosk-silverblue && sudo sh install-kiosk.sh && sudo systemctl restart gdm'
+ssh client 'cd /tmp/kiosk-silverblue && sudo sh check-kiosk.sh'
+```
+
+Because nobody is standing at the machine, every claim about it is verified from
+the outside: `loginctl` for the session, the server's `/api/streams` for the
+viewer, the sharer's own peer state for the media, and a probe page for the
+rendered resolution. The runbook records why each file lives where it does on an
+otherwise read-only OS.
+
 ## Development
 
 ```bash