feat: give the classroom a desktop instead of a shell

The whole appliance UI is now configuration for a desktop Debian already
ships: a Plasma 6.3 session with a colour scheme, a look and feel package
that builds the bar, window rules, and KDE's own Kiosk restrictions.

Two things were measured rather than assumed, and both changed a decision.

Plasma restarts a crashed panel three times a minute and then gives up,
which is the failure a classroom has already had. Four lines of systemd
drop-in make it unconditional; the panel then survived eight SIGKILLs a
second apart, back each time in 2.4s.

Plasma draws a minimised task and a background task identically, so the
five states the room needs cannot all be shown. Rather than write a task
manager, the classroom removes minimise: clicking a launcher always means
show me this.

Co-Authored-By: Claude Opus 5 <[email protected]>

scripts/classroom-wonderink

@@ -0,0 +1,39 @@
+#!/bin/bash
+set -euo pipefail
+
+# Wonder Ink as an application, not a tab.
+#
+# Two things make it one. It runs in Chrome's app mode, so the window has
+# no tab strip and no address bar and reads as a program. And it runs in
+# its own Chrome profile, so the teacher signed into Wonder Ink and the
+# room's shared YouTube account are separate sessions that cannot reach
+# each other:
+#
+#   * closing this window ends the Wonder Ink session, because the
+#     wonderink.org cookies are session-only by policy and this profile's
+#     browser process exits with the window;
+#   * a Google sign-in performed here cannot be used to re-enter the
+#     previous teacher's Wonder Ink account from the ordinary browser,
+#     because the ordinary browser's Google session is in a different
+#     profile;
+#   * and the church YouTube login in the ordinary browser survives all of
+#     it, because nothing here touches that profile.
+#
+# The machine-wide policy in /etc/opt/chrome/policies applies to every
+# profile, so this window is governed by exactly the same rules as the
+# browser.
+
+HOME_PAGE='https://app.wonderink.org/'
+PROFILE="${XDG_DATA_HOME:-$HOME/.local/share}/ekklesia-classroom/wonderink"
+
+mkdir -p "$PROFILE"
+
+exec google-chrome \
+    --user-data-dir="$PROFILE" \
+    --app="$HOME_PAGE" \
+    --ozone-platform=wayland \
+    --no-first-run \
+    --no-default-browser-check \
+    --password-store=basic \
+    --hide-crash-restore-bubble \
+    "$@"