feat: give the classroom a desktop instead of a shell

The whole appliance UI is now configuration for a desktop Debian already
ships: a Plasma 6.3 session with a colour scheme, a look and feel package
that builds the bar, window rules, and KDE's own Kiosk restrictions.

Two things were measured rather than assumed, and both changed a decision.

Plasma restarts a crashed panel three times a minute and then gives up,
which is the failure a classroom has already had. Four lines of systemd
drop-in make it unconditional; the panel then survived eight SIGKILLs a
second apart, back each time in 2.4s.

Plasma draws a minimised task and a background task identically, so the
five states the room needs cannot all be shown. Rather than write a task
manager, the classroom removes minimise: clicking a launcher always means
show me this.

Co-Authored-By: Claude Opus 5 <[email protected]>

scripts/classroom-browser

@@ -1,32 +1,33 @@
 #!/bin/bash
 set -euo pipefail
 
-# The dock's Browser button. classroom-window decides whether this is a
-# launch, a focus, a minimise or a restore.
+# The room's ordinary browser: YouTube, and anywhere else a lesson goes.
 #
-# Chrome stays a full browser: Wonder Ink is only the starting page, and
-# the profile in ~/.config/google-chrome is never touched here so logins
-# and cookies survive reboots and updates.
+# It is a full browser with a tab strip and an address bar, in the room's
+# own profile, so the church YouTube sign-in survives reboots and updates.
+# Wonder Ink is a separate application in a separate profile and is not
+# reachable from this one.
+#
+# There is no launch/focus/minimise/restore logic here any more. The panel
+# owns that: it knows this window by StartupWMClass and does the right
+# thing with a click, including telling the teacher which of those four
+# states the application is in.
 #
 # --hide-crash-restore-bubble is what suppresses "Restore pages? Chrome
-# didn't shut down correctly" after a reboot. Note the switch name: the
+# didn't shut down correctly" after a power cut. Note the switch name: the
 # older --disable-session-crashed-bubble is not present in Chrome 152 at
-# all, so it would have silently done nothing. Verified against the
-# strings of the installed binary.
+# all, so it would have silently done nothing.
 
-HOME_PAGE='https://app.wonderink.org/'
+# Not Wonder Ink. Wonder Ink is its own application in its own profile,
+# and a second way in through this window would put a teacher's lesson
+# session in the room's shared browser profile — the exact leak the split
+# exists to prevent.
+HOME_PAGE='https://www.youtube.com/'
 
-exec /usr/local/bin/classroom-window toggle \
-    --match 'google-chrome' \
-    --match 'chrome' \
-    --match 'chrome-.*' \
-    --match 'google-chrome-.*' \
-    -- \
-    google-chrome \
-        --ozone-platform=wayland \
-        --start-maximized \
-        --no-first-run \
-        --no-default-browser-check \
-        --password-store=basic \
-        --hide-crash-restore-bubble \
-        "$HOME_PAGE"
+exec google-chrome \
+    --ozone-platform=wayland \
+    --no-first-run \
+    --no-default-browser-check \
+    --password-store=basic \
+    --hide-crash-restore-bubble \
+    "${@:-$HOME_PAGE}"

scripts/classroom-wonderink

@@ -0,0 +1,39 @@
+#!/bin/bash
+set -euo pipefail
+
+# Wonder Ink as an application, not a tab.
+#
+# Two things make it one. It runs in Chrome's app mode, so the window has
+# no tab strip and no address bar and reads as a program. And it runs in
+# its own Chrome profile, so the teacher signed into Wonder Ink and the
+# room's shared YouTube account are separate sessions that cannot reach
+# each other:
+#
+#   * closing this window ends the Wonder Ink session, because the
+#     wonderink.org cookies are session-only by policy and this profile's
+#     browser process exits with the window;
+#   * a Google sign-in performed here cannot be used to re-enter the
+#     previous teacher's Wonder Ink account from the ordinary browser,
+#     because the ordinary browser's Google session is in a different
+#     profile;
+#   * and the church YouTube login in the ordinary browser survives all of
+#     it, because nothing here touches that profile.
+#
+# The machine-wide policy in /etc/opt/chrome/policies applies to every
+# profile, so this window is governed by exactly the same rules as the
+# browser.
+
+HOME_PAGE='https://app.wonderink.org/'
+PROFILE="${XDG_DATA_HOME:-$HOME/.local/share}/ekklesia-classroom/wonderink"
+
+mkdir -p "$PROFILE"
+
+exec google-chrome \
+    --user-data-dir="$PROFILE" \
+    --app="$HOME_PAGE" \
+    --ozone-platform=wayland \
+    --no-first-run \
+    --no-default-browser-check \
+    --password-store=basic \
+    --hide-crash-restore-bubble \
+    "$@"