rename: webmux → offdesk, plus MIT licence and a rewritten README

[renyuanz]

Renames the project to offdesk, adds the MIT licence, and rewrites the README
for first-time users.

The marketing site was split out into #307 — it has no code dependency on this,
so the two can merge in either order.

Four commits, meant to be read in order. The rename is mechanical and large;
everything after it is small.

What changed

rename: webmux → offdesk — crates tc-* → offdesk-*; binaries
webmux-server/webmux-node/webmux → offdesk-hub/offdesk-node/offdesk;
WEBMUX_* → OFFDESK_*; config dir → <config_dir>/offdesk; API tokens minted
odk_. Also the @webmux/* npm scope, bundle ids (com.webmux.* →
dev.offdesk.*), the OAuth deep link, the container image, the SQLite filename,
and the tmux socket.

license: MIT — LICENSE at the root plus a license field on every
Cargo.toml and package.json.

docs: rewrite README… — README rewritten for someone who has never seen
this; development and architecture moved to a new CONTRIBUTING.md. New
docs/setup-lan.md, docs/setup-public.md, SECURITY.md,
docs/media/README.md.

docs: repo metadata… — docs/github-metadata.md (description, topics, and
the one-time rename checklist) and a docs/launch/show-hn.md stub.

Nothing on an existing install breaks

This is the part worth reviewing closely.

• Config directory — offdesk_protocol::config_dir() moves
  <config_dir>/webmux into place on first use, so a registered machine keeps
  machine.json, its terminal metadata, and tmux.user.conf. Only moves when
  the destination does not exist.
• Tokens — the hub still accepts wmx_ tokens; it just never mints new
  ones. Nobody has to reissue.
• Environment — WEBMUX_* still works, each with a deprecation notice on
  stderr.
• tmux sessions — tmux cannot move a session between servers, so pty.rs
  resolves its socket at startup: a node whose old webmux socket still holds
  wmx_ sessions keeps using it and moves to offdesk once they are all
  closed. Resolution is explicit rather than lazy, so unit tests do not depend
  on which tmux servers happen to be running on the box — that bit me, and the
  legacy detection is why.
• Browser state — the web app copies webmux:* localStorage keys to
  offdesk:* once, so clients keep their hub URL, fonts, and layout.

One manual step for the existing deployment: the container's SQLite path
moved from /app/data/tc.db to /app/data/offdesk.db, and the volume from
webmux-data to offdesk-data. Commands are in docs/setup-public.md under
"Upgrading a webmux deployment". Without it the hub starts on an empty database
and every machine looks unregistered.

Verification

Check	Result
cargo build --release	3 binaries
cargo test --workspace	228 passed, 0 failed
pnpm test	351 passed
pnpm typecheck	clean
pnpm build	clean
pnpm e2e:ci	90 passed, 1 failed (flaky, see below)

The e2e failure is mobile touch drag sends terminal scroll input. Re-ran it
3× in isolation, passes every time — a timing-sensitive wheel-frame assertion,
not the rename. The renamed test globals matched; the test reached the wheel
assertion before failing.

Things a reviewer should decide

1. The remote is zalify/offdesk.dev, not zalify/offdesk. Per the brief I
   assumed github.com/zalify/offdesk everywhere — links, and the Tauri updater
   endpoint. Those 404 until the repo is renamed. If the repo keeps its current
   name, these need flipping.
2. The README comparison table is 25 TODO cells. The rule was cite a URL
   or write TODO, never guess, so only offdesk's row is filled — from
   docs/facts.md. The README should not be treated as publishable until these
   are sourced. Same table, same caveat, in site: offdesk.dev marketing site on Astro #307.
3. docs/plans/ and docs/superpowers/ bodies are untouched. They are
   dated records; rewriting ~40 of them would falsify what was decided when.
   Each directory gets a README.md saying the commands inside use pre-rename
   names. Easy to change if you disagree.

Also worth knowing

docs/facts.md is new: verified facts about the shipping system, each citing
the file it came from. README and site copy only assert things on that list.

Writing it turned up something that changed the docs: the web client calls
/api/auth/dev automatically. With OFFDESK_DEV_MODE=true, anyone who opens
the hub URL is signed in as a shared user, unprompted. That is what makes the
LAN setup take five minutes, and it is why setup-lan.md has a "what this does
not protect" section and SECURITY.md leads on it.

Two README claims did not survive fact-checking and were corrected rather than
carried over: the CLI config path is ~/Library/Application Support/offdesk/ on
macOS, not ~/.config/offdesk/; and the CLI device id is
cli-send-<pid>/cli-read-<pid>, not cli-<hostname>.

Still to do before launch: record docs/media/hero.gif, and tag a v* release
so the install script in #307 has binaries to fetch.

🤖 Generated with Claude Code

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_04413ebe-e236-4909-a611-842a6dc4c1b8)