Update ISO installer tiers and backend deployment

ansible/roles/cezen-ttyd/files/cezen-ttyd.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Cezen Web Terminal (ttyd)
+After=network.target
+
+[Service]
+# Bind to localhost only — Nginx proxies /console/ to this port
+ExecStart=/usr/bin/ttyd \
+    --port 7681 \
+    --interface 127.0.0.1 \
+    --writable \
+    login -f cezen-console
+Restart=always
+RestartSec=5
+User=root
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/cezen-ttyd/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: Reload systemd
+  systemd:
+    daemon_reload: yes
+
+- name: Restart cezen-ttyd
+  systemd:
+    name: cezen-ttyd
+    state: restarted

ansible/roles/cezen-ttyd/tasks/main.yml

@@ -0,0 +1,72 @@
+---
+# cezen-ttyd role: browser-based terminal via ttyd, bound to localhost
+
+- name: Install ttyd
+  apt:
+    name: ttyd
+    state: present
+    update_cache: yes
+
+- name: Create cezen-console restricted user
+  user:
+    name: cezen-console
+    shell: /bin/bash
+    comment: "Cezen Web Console User"
+    groups: "{{ cezen_user }}"
+    append: yes
+    state: present
+    create_home: yes
+
+- name: Set cezen-console password
+  # Change this password after first login or use PAM/SSO integration
+  shell: echo "cezen-console:CezenConsole2024!" | chpasswd
+  changed_when: false
+  no_log: true
+
+- name: Restrict cezen-console home directory
+  file:
+    path: /home/cezen-console
+    owner: cezen-console
+    group: cezen-console
+    mode: "0750"
+
+- name: Add useful aliases for console user
+  copy:
+    dest: /home/cezen-console/.bashrc
+    owner: cezen-console
+    group: cezen-console
+    mode: "0644"
+    content: |
+      # Cezen Web Console — restricted shell environment
+      PS1='\[\033[01;32m\]cezen-console\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
+
+      # Useful shortcuts
+      alias ll='ls -lah --color=auto'
+      alias logs='journalctl -u cezen-api -f'
+      alias api-status='systemctl status cezen-api'
+      alias ollama-ps='ollama ps'
+      alias gpu='nvidia-smi'
+      alias ports='ss -tlnp'
+
+      # Prevent accidental system damage
+      alias rm='rm -i'
+      alias mv='mv -i'
+      alias cp='cp -i'
+
+- name: Install ttyd systemd service
+  copy:
+    src: cezen-ttyd.service
+    dest: /etc/systemd/system/cezen-ttyd.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart cezen-ttyd
+
+- name: Enable and start ttyd service
+  systemd:
+    name: cezen-ttyd
+    enabled: yes
+    state: started
+    daemon_reload: yes