P1 spine: monorepo, shared WS protocol, server daemon

- npm workspaces (shared / server / web), TS strict, project refs
- @arboretum/shared: multiplexed WS protocol (JSON control + binary
  output frames: 1B type + u32le channel), flow-control constants
  (ACK 256K, HIGH 384K, LOW 128K, lagging 2M), REST types
- git-arboretum server: Fastify 5 + node:sqlite (single native dep:
  node-pty prebuilt), token auth (sha256 at rest, HMAC cookie, global
  login rate limit + backoff), strict Origin check on /api and /ws,
  PtyManager (2MiB ring with monotonic offset, resync replay = reset +
  256KiB tail, pause/resume only when ALL interactive clients exceed
  HIGH, observers never throttle, lagging clients resync), WS gateway
  (attach/stdin/resize/ack, heartbeat 30s), SIGTERM→SIGKILL 5s grace
- CLI: arboretum [--port 7317] [--bind 127.0.0.1] — non-loopback bind
  requires an explicit safety flag
- Smoke-tested: login/401/403-origin/spawn bash/kill/grace-SIGKILL all
  green

packages/server/src/index.ts

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadConfig } from './config.js';
+import { openDb } from './db/index.js';
+import { buildApp } from './app.js';
+
+const pkg = JSON.parse(
+  readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'),
+) as { version: string };
+
+async function main(): Promise<void> {
+  const config = loadConfig();
+  const db = openDb(config.dbPath);
+  const { app, auth, manager } = buildApp(config, db, pkg.version);
+
+  const bootstrapToken = auth.ensureBootstrapToken();
+  await app.listen({ port: config.port, host: config.bind });
+
+  const url = `http://${config.bind === '0.0.0.0' ? '127.0.0.1' : config.bind}:${config.port}`;
+  app.log.info(`Arboretum v${pkg.version} — ${url}`);
+  if (bootstrapToken) {
+    // Affiché une seule fois : le hash seul est stocké.
+    console.log('\n┌──────────────────────────────────────────────────────────────────┐');
+    console.log('│  First start — your access token (shown once, store it safely):  │');
+    console.log('└──────────────────────────────────────────────────────────────────┘');
+    console.log(`\n  ${bootstrapToken}\n`);
+    console.log(`  Login at: ${url}/\n`);
+  } else if (config.printToken) {
+    console.log('Tokens are stored hashed and cannot be re-printed. Create a new one from Settings (or reset the db).');
+  }
+
+  let shuttingDown = false;
+  const shutdown = (signal: string): void => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    app.log.info(`${signal} received — draining sessions then exiting`);
+    manager.shutdown();
+    setTimeout(() => {
+      void app.close().then(() => process.exit(0));
+    }, 1000).unref();
+  };
+  process.on('SIGINT', () => shutdown('SIGINT'));
+  process.on('SIGTERM', () => shutdown('SIGTERM'));
+}
+
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : err);
+  process.exit(1);
+});