docs: kiosk-desktop post-merge audit — document self-service mode + fix stale agent systemd docs

[thevladbog]

Summary

Requested audit after K2b merged, closing out the full kiosk-desktop initiative (K1/K2a/K2b/K3a/K3b): "check everything is OK — linters, flows, deployment/signing docs."

Verified clean, no action needed:

• npm run lint -w idento-desktop / -w @idento/ui — 0 errors
• cargo clippy --all-targets (desktop/src-tauri) — clean (first time this has actually been run across the whole initiative)
• go vet ./... / go test ./... (agent) — clean
• All CI workflow YAML (ci.yml, release.yml, release-desktop.yml, validate.yml) — valid, path-filters correctly scoped (desktop/**, agent/**), and PR feat(desktop): K2b — self-service kiosk mode (attract screen, lockdown, staff-QR exit) #105 itself already proved the real Build Desktop (Tauri) CI job passes post-K2b

Found and fixed (docs only, no code changes):

1. desktop/README.md had zero documentation of K2b's self-service mode — a security-relevant, user-facing feature (window lockdown, staff-QR exit) with no explanation of how to enable it, what the exit token is, or the still-open real-hardware verification gap. Added a section.
2. agent/README.md's "Production Deployment" section hand-wrote a stale, simplified systemd unit (no --host 0.0.0.0, wrong binary path, no auth-token/dialout guidance) that predates K3a's actual, tested agent/dist/install.sh + idento-agent.service. Repointed at the real bundle as the recommended path; kept a manual fallback for non-standard installs.

Test plan

• Lint/clippy/vet/test all re-verified clean
• CI YAML syntax validated
• Both README diffs read back for accuracy against the actual shipped code (agent/dist/install.sh, desktop/src/pages/Mode.tsx, StaffExitOverlay.tsx)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Added recommended standalone Linux/systemd deployment instructions using the provided installer.
  • Documented manual Linux service configuration as an alternative.
  • Added guidance for connecting desktop clients in external mode.
  • Documented self-service mode for unattended stations, including scanner-only input, privacy-safe screens, automatic reset, window lockdown, and staff exit flow.
  • Noted that Tauri API behavior remains unverified on real hardware.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

@thevladbog, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0fa7ccb0-93e3-4c9b-9af2-98ed7c85dc71

📥 Commits

Reviewing files that changed from the base of the PR and between 3fbafb5 and e1e2a4f.

📒 Files selected for processing (1)

• agent/README.md

📝 Walkthrough

Walkthrough

The documentation updates describe standalone and manual Linux systemd deployment for the agent, and add operational guidance for desktop self-service stations, including restrictions, lockdown, staff exit, and a hardware-testing note.

Changes

Agent deployment documentation

Layer / File(s)	Summary
Systemd installation workflows agent/README.md	Documents standalone bundle installation with dist/install.sh, generated service configuration and connection details, plus manual binary and unit-file installation steps.

Desktop self-service documentation

Layer / File(s)	Summary
Unattended station behavior desktop/README.md	Documents self-service configuration, scanner-only input, attract-screen behavior, window lockdown, staff QR exit, and the known hardware-testing gap.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• thevladbog/idento#101: Adds the standalone Linux agent bundle and external-agent connection behavior documented here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main documentation updates: self-service mode and refreshed agent systemd deployment guidance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/kiosk-desktop-docs-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agent/README.md`:
- Around line 253-257: Update the Russian README text describing the bundle in
agent/dist/ so it states that the bundle contains an already-built binary, not
that it compiles one; keep the surrounding installation behavior unchanged.
- Around line 274-285: Update the “Ручная настройка (без install.sh)” command
block to explicitly switch to agent/dist or use repository-root-relative paths
before referencing idento-agent and idento-agent.service, ensuring the manual
fallback is copy-pasteable without relying on the preceding workflow.
- Line 271: Update the malformed reference in the agent README text near
“Connecting to a standalone agent (external” by replacing the mixed
``desktop/README.md`'s`` construction with natural Russian wording such as “в
разделе … файла `desktop/README.md`”, while preserving the referenced section.
- Around line 280-285: Update the manual installation instructions around the
idento-agent systemd setup to ensure the configured service user is a member of
the dialout group, either by adding the equivalent usermod command or clearly
documenting it as a prerequisite before enabling the service.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 27f0d6f3-0150-47a1-aca8-cbc26839a97a

📥 Commits

Reviewing files that changed from the base of the PR and between 15844ca and 3fbafb5.

📒 Files selected for processing (2)

• agent/README.md
• desktop/README.md