P1 spine: monorepo, shared WS protocol, server daemon

- npm workspaces (shared / server / web), TS strict, project refs
- @arboretum/shared: multiplexed WS protocol (JSON control + binary
  output frames: 1B type + u32le channel), flow-control constants
  (ACK 256K, HIGH 384K, LOW 128K, lagging 2M), REST types
- git-arboretum server: Fastify 5 + node:sqlite (single native dep:
  node-pty prebuilt), token auth (sha256 at rest, HMAC cookie, global
  login rate limit + backoff), strict Origin check on /api and /ws,
  PtyManager (2MiB ring with monotonic offset, resync replay = reset +
  256KiB tail, pause/resume only when ALL interactive clients exceed
  HIGH, observers never throttle, lagging clients resync), WS gateway
  (attach/stdin/resize/ack, heartbeat 30s), SIGTERM→SIGKILL 5s grace
- CLI: arboretum [--port 7317] [--bind 127.0.0.1] — non-loopback bind
  requires an explicit safety flag
- Smoke-tested: login/401/403-origin/spawn bash/kill/grace-SIGKILL all
  green

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/server/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "git-arboretum",
+  "version": "0.1.0",
+  "description": "Self-hosted web dashboard for git worktrees and the Claude Code sessions running on them",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "arboretum": "./dist/index.js"
+  },
+  "main": "./dist/app.js",
+  "files": [
+    "dist",
+    "public"
+  ],
+  "engines": {
+    "node": ">=22.16"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "tsc -b --watch & node --watch dist/index.js",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@arboretum/shared": "0.1.0",
+    "@fastify/cookie": "^11.0.0",
+    "@fastify/static": "^8.0.0",
+    "@fastify/websocket": "^11.0.0",
+    "@homebridge/node-pty-prebuilt-multiarch": "^0.13.0",
+    "fastify": "^5.0.0"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.5.0"
+  }
+}