vnc sidecar: per-user desktop sessions via sidecar architecture

replaces the single hardcoded systemd VNC service with a dynamic
sidecar that manages per-user VNC sessions on demand. any authenticated
user can now access their own desktop, not just Super Admin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ecosystem.config.cjs

@@ -7,9 +7,21 @@ module.exports = {
       watch: false,
     },
     {
-      name: 'officer-sidecar',
+      name: 'officer-claude',
       script: 'bun',
-      args: 'run src/servers/sidecar/index.ts',
+      args: 'run src/servers/sidecar/claude/index.ts',
+      watch: false,
+    },
+    {
+      name: 'officer-pi',
+      script: 'bun',
+      args: 'run src/servers/sidecar/pi/index.ts',
+      watch: false,
+    },
+    {
+      name: 'officer-email',
+      script: 'bun',
+      args: 'run src/servers/sidecar/email/index.ts',
       watch: false,
     },
     {
@@ -18,5 +30,11 @@ module.exports = {
       args: 'src/servers/api/terminal/pty-sidecar.mjs',
       watch: false,
     },
+    {
+      name: 'officer-vnc',
+      script: 'bun',
+      args: 'run src/servers/sidecar/vnc/index.ts',
+      watch: false,
+    },
   ],
 };