move host setup into scripts/setup/

scripts/ was holding two unrelated kinds of thing: install-this-machine, and run-this-occasionally. The
eight installers now live in scripts/setup/; what stays at the top level is the build steps (gen-index,
prebuild, build/) and the two maintenance scripts (reindex-music, rebuild-soulseek-tree).

The move is not just a rename. Three of these derive the repo root from their own location:

  setup.sh:51            PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
  setup_mac_light.sh:51  same
  cleanup-desktop.sh:134 ENV_FILE="$(dirname "$0")/../.env"

Left alone, all three would now resolve to scripts/ — and nothing downstream complains. PROJECT_DIR is
where .env is written, where `bun install`, `gen:index` and `db:push` run, and what pm2 is pointed at, so
a fresh install would have quietly provisioned scripts/ and reported success. cleanup-desktop.sh fails
the other way: it would find no .env, print "No .env — skipping", and leave the real VNC_PASSWORD in the
real file. All three are now `../..` with a comment saying why the level matters.

provision-user-dirs.ts imports data-path.ts relatively; that one tsgo caught.

Also disambiguated `setup.sh` where it had become two files. app-store/templates/<name>/setup.sh is a
per-sidecar installer with its own contract, and preflight.ts + docs/sidecar-app-store.md discussed both
in the same paragraph. The host one is now spelled with its full path at those sites.

Verified: bash -n on all six shell scripts, tsgo clean, os-user tests pass, both derivations resolve to
the repo root, starship.toml still resolves from os-user-shell.ts, and provision-user-dirs.ts runs under
DRY_RUN.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/officer-set-display.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Pick the largest sane mode on whichever output is connected, at session start.
+#
+# With no monitor attached the connector's EDID comes from drm.edid_firmware (see the kernel command
+# line). That EDID advertises plenty of modes but its *preferred* one is the captured screen's native
+# resolution, which may be tiny — GNOME picks preferred, so an 800x480 panel yields an 800x480
+# desktop. monitors.xml is the documented override but its monitor matching proved unreliable here,
+# so set the mode directly. No-ops when the mode is already right, so it is safe to run repeatedly.
+set -eu
+
+MAX_WIDTH="${OFFICER_MAX_WIDTH:-1920}"
+
+# The session's X server may not be up yet when autostart fires.
+for _ in $(seq 1 20); do
+  xrandr --query >/dev/null 2>&1 && break
+  sleep 0.5
+done
+xrandr --query >/dev/null 2>&1 || exit 0
+
+output=$(xrandr --query | awk '/ connected/ { print $1; exit }')
+[ -n "$output" ] || exit 0
+
+# Modes are listed under the output but are not reliably sorted, so pick the widest that fits.
+mode=$(
+  xrandr --query \
+    | sed -n "/^${output} connected/,/^[^ ]/p" \
+    | awk '/^[[:space:]]+[0-9]+x[0-9]+/ { print $1 }' \
+    | awk -F x -v max="$MAX_WIDTH" '
+        { w = $1 + 0; h = $2 + 0 }
+        w <= max && (w > bw || (w == bw && h > bh)) { bw = w; bh = h; best = $0 }
+        END { if (best) print best }'
+)
+[ -n "$mode" ] || exit 0
+
+current=$(xrandr --query | awk -v o="$output" '$1 == o { print $3 }' | cut -d+ -f1)
+[ "$current" = "$mode" ] && exit 0
+
+xrandr --output "$output" --mode "$mode" || true