delete the bug-report discord webhook, and the last dead HOME_DIR reads

DISCORD_BUG_REPORT_WEBHOOK is gone, with sendToDiscord and its helpers. Reports
still land in DATA_PATH/bug-reports — the disk write always happened first and
the webhook was only a ping about it, so nothing about the report is lost.

It was a personal notification channel living in deployment config, on a platform
whose owner is the only person who files reports. It was also never in
.env.example: the setup script wrote a variable nothing documented, which is the
same drift as PORT, in the other direction.

Note DISCORD_WEBHOOK_URL is a DIFFERENT variable — the notify sidecar's own
channel — and is untouched.

Then a parity sweep of setup / .env.example / what the code reads, which turned
up two leftovers from earlier today:

HOME_DIR was still read in six files, each with its own `?? homedir()` fallback.
Dead since nothing sets it, but a dead read is worse than none — it reads as a
supported override. They take homedir() directly now. user-instance.ts gets a
comment on why its line stays where it is: it sits above `process.env.HOME =
homeDir`, and homedir() reads $HOME, so a read moved below that assignment would
return whichever member was last spawned into. Two of the six had fallback chains
ending in process.cwd() and '' — the second would have silently disabled whatever
consumed it rather than failing.

VAULTWARDEN_URL was uncommented in .env.example among the variables setup writes,
though it is a plugin variable setup has never written. Commented out with the
other plugin entries.

The three files now agree: setup writes PORT, BROWSER_RELAY_PORT and
POSTGRES_URL; .env.example lists those plus JWT_SECRET and VAULT_STORE_KEY, which
are required by code and deliberately unwritten until the secret store lands.

Not typechecked (empty node_modules, frozen installs). Every changed file parses;
the setup section was run and writes three variables.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/sidecar/pty/sessions.mjs

@@ -1,5 +1,6 @@
 import { join } from 'node:path';
 import * as pty from 'node-pty';
+import { homedir } from 'node:os';
 
 // The shell store. Everything about running a terminal lives here: what shell, where it opens, how much
 // scrollback is kept, who is watching. The platform holds none of it — it authenticates a browser and
@@ -11,7 +12,7 @@ const BUFFER_MAX = 512 * 1024;
 
 // HOME_DIR mirrors `data-path.ts:getOwnerHomeDir` — on a host where the owner's real login home differs
 // from this process's HOME, the shell should open in the former, like every other host-executing surface.
-const HOME_DIR = process.env.HOME_DIR ?? process.env.HOME ?? process.cwd();
+const HOME_DIR = homedir();
 const SHELL = { command: process.env.SHELL ?? '/bin/zsh', args: ['-i'] };
 
 // A terminal is always a plain host shell: the owner is the only account and it is their own machine