move the pty sidecar under src/servers/sidecar

it was the only sidecar living outside src/servers/sidecar/ — it sat in
api/terminal/ next to the bridge that talks to it, which is the one place a reader
looking for "the sidecars" would not check. now src/servers/sidecar/pty/index.mjs,
matching every peer, with a note on the pm2 entry about why this one is node and
.mjs (node-pty is a native addon) rather than bun and typescript like the rest.

the templates/ directory went to api/users/, next to provision.ts:seedShellConfigs,
which is now its only consumer — the sidecar's duplicate seeder went with the
sandbox branch in the previous commit. api/terminal/ is left holding exactly one
thing: the websocket bridge.

no behaviour change. the pm2 entry's script path changed, so `pm2 restart
officer-pty` is not enough — pm2 remembers the old path until the entry is deleted
and started again. commands are in SIDECAR_WORK_LOG.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/users/provision.ts

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { DATA_PATH, getHomeDir, toShellUsername } from '@@/data-path';
 import { generateContainerContext, generateClaudeSettings } from '@@/generate-container-context';
 
-const TEMPLATE_DIR = join(import.meta.dir, '../terminal/templates');
+const TEMPLATE_DIR = join(import.meta.dir, 'templates');
 
 const copyTemplate = async (src: string, dest: string) => {
   if (existsSync(dest)) return;

src/servers/sidecar/pty/index.test.ts

@@ -8,7 +8,7 @@ import type { ServerWebSocket, Subprocess } from 'bun';
 //
 // Nothing here touches the running officer — the sidecar dials API_URL, which is overridden per spawn.
 
-const SIDECAR = 'src/servers/api/terminal/pty-sidecar.mjs';
+const SIDECAR = 'src/servers/sidecar/pty/index.mjs';
 
 type Frame = Record<string, any>;