put every http sidecar on the proxy factory

createSidecarProxy arrived with the wallet but nothing else moved onto it, so five sidecars
still carried their own copy of the same two files: a sidecar-server.ts that remembered a
port announced as `<name>:server`, and a router.ts that forwarded the subpath. Byte for
byte identical once the app name was normalised away — which is exactly what the factory's
own header said it existed to end.

headscale, transmission, invoiceshelf, slskd and music are now wallet-shaped: create the
proxy, export the router and the URL getter. 386 lines deleted against 163 added, and the
five feature directories go from ~70 lines each to ~18.

Two deviations were real and moved INTO the factory rather than being dropped, because both
are HTTP concerns rather than app knowledge:

- Range and If-None-Match are now forwarded for every sidecar. music needed both (seeking,
  and ETag revalidation returning a cheap 304 instead of a cover image) and slskd needed
  Range. Forwarding them everywhere costs nothing and removes the reason to hand-roll.
- timeoutSeconds, used only by music at 1800. A from-scratch reindex holds the proxied
  connection open for minutes with no bytes flowing, which the 60s idle timeout would drop.
  It applies to the whole prefix — the proxy must not know which of a sidecar's routes are
  slow.

The five side-effect imports in hono.ts are gone with them: the port listener now registers
when createSidecarProxy runs inside the router this file already imports. Vault keeps its
hand-rolled pair and its side-effect import — it is off-limits by standing instruction, and
is the one sidecar this commit deliberately does not touch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/api/headscale/router.ts

@@ -1,50 +1,18 @@
-import { createRouter } from '../../create-router';
-import { getHeadscaleServerUrl } from './sidecar-server';
+import { createSidecarProxy } from '../../sidecar/create-proxy';
 
-// Thin reverse-proxy for /api/headscale/*. The platform's ONLY job here is AUTH + FORWARDING: this router
-// mounts under the protected /api tree (userMiddleware upstream authenticates the owner), then forwards the
-// subpath + query + body to the officer-headscale sidecar, which OWNS the Headscale contract and holds the
-// admin API key.
+// /api/headscale/* — auth, then forward to officer-headscale. No routes of its own and no headscale knowledge:
+// this file must never grow app logic.
 //
-// A catch-all with no routes of its own. Unlike /api/slskd this proxies nothing of the upstream's own
-// surface — the sidecar exposes only Officer-owned routes under /_officer/, because Headscale's REST shape
-// differs across releases and version handling belongs in the sidecar, not the browser. The full contract
-// is documented at the top of src/servers/sidecar/headscale/index.ts. It is opaque from here: this file
-// must never grow Headscale logic.
+// The sidecar exposes only Officer-owned routes under `/_officer/` — Headscale's REST shape differs
+// across releases, and version handling belongs in the sidecar. It holds the admin API key; the platform
+// does not know Headscale's URL.
 
-export const headscaleRouter = createRouter();
-
-const PREFIX = '/api/headscale';
-
-headscaleRouter.all('/*', async (ctx) => {
-  const baseUrl = getHeadscaleServerUrl();
-  if (!baseUrl) return ctx.text('headscale sidecar not available', 503);
-
-  const url = new URL(ctx.req.url);
-  const subpath = url.pathname.slice(PREFIX.length) || '/';
-  const target = `${baseUrl}${subpath}${url.search}`;
-
-  const method = ctx.req.method;
-  const headers: Record<string, string> = {};
-  const contentType = ctx.req.header('content-type');
-  if (contentType) headers['Content-Type'] = contentType;
-  // Forward the authenticated user id so the sidecar can serve its Officer-owned routes. The sidecar binds
-  // loopback only, so this header is trusted.
-  headers['X-Officer-User'] = String(ctx.get('user').id);
-
-  const hasBody = method !== 'GET' && method !== 'HEAD';
-
-  let upstream: Response;
-  try {
-    upstream = await fetch(target, {
-      method,
-      headers,
-      body: hasBody ? await ctx.req.arrayBuffer() : undefined,
-    });
-  } catch (err) {
-    console.error('[headscale] proxy fetch failed', { target, error: String(err) });
-    return ctx.text('headscale sidecar unreachable', 502);
-  }
-
-  return new Response(upstream.body, { status: upstream.status, headers: new Headers(upstream.headers) });
+const proxy = createSidecarProxy({
+  name: 'headscale',
+  prefix: '/api/headscale',
 });
+
+export const headscaleRouter = proxy.router;
+
+/** Base URL of the sidecar's HTTP server, or null if it hasn't reported in yet. */
+export const getHeadscaleServerUrl = proxy.getHttpUrl;

src/servers/api/headscale/sidecar-server.ts

@@ -1,19 +0,0 @@
-import * as sidecar from '@@/sidecar-registry';
-
-// The officer-headscale sidecar starts its HTTP server on a random loopback port and reports it here on
-// connect. We remember it so `/api/headscale/*` always forwards to the current sidecar. The platform holds
-// NO knowledge of Headscale itself — not its URL, and emphatically not its admin API key.
-
-let serverPort: number | null = null;
-
-sidecar.on('headscale:server', (msg) => {
-  const port = (msg as { port?: number }).port;
-  if (typeof port !== 'number') return;
-  serverPort = port;
-  console.log(`[headscale] sidecar registered on port ${port}`);
-});
-
-/** Base URL of the sidecar's HTTP server, or null if the sidecar hasn't reported in yet. */
-export function getHeadscaleServerUrl(): string | null {
-  return serverPort ? `http://127.0.0.1:${serverPort}` : null;
-}