Add runtime-configured Lab 3 browser terminal

docs/lab3-terminal-deployment.md

@@ -1,32 +1,35 @@
 # Lab 3 Embedded Terminal Deployment
 
-Lab 3 now expects a same-origin WeTTY endpoint mounted at `/wetty` by default.
+Lab 3 now prefers a runtime config artifact served at `/courseware-runtime.json`.
+
+Default runtime config:
+
+```json
+{
+  "lab3TerminalUrl": "http://127.0.0.1:7681/wetty",
+  "lab3Username": "student",
+  "lab3WorkingDirectory": "/home/student/lab3"
+}
+```
 
 ## Runtime Contract
 
-- Run WeTTY on the lab host, bound to `127.0.0.1`
-- Mount it behind the same public origin as the Next.js app
-- Let the reverse proxy handle WebSocket upgrade for `/wetty`
-- Launch WeTTY as root so it uses `/bin/login` locally
-- Keep SSH available as a fallback path, not the primary student UX
+- Create a managed `student` Unix account
+- Bind `sshd` to `127.0.0.1:22` only
+- Run WeTTY on the lab host and expose it to the browser at `/wetty`
+- Point WeTTY at localhost SSH without pre-setting the username so students see a login prompt
+- Start students in `/home/student/lab3`
 
 Example launch command:
 
 ```bash
-wetty --host 127.0.0.1 --port 3001 --base /wetty --allow-iframe
+wetty --host 0.0.0.0 --port 7681 --base /wetty --allow-iframe --ssh-host 127.0.0.1 --ssh-port 22 --ssh-auth password
 ```
 
-## Proxmox VM Shape
+## Linux / WSL Shape
 
-- Install WeTTY as a system service
-- Keep it bound to localhost only
-- Reverse proxy `/wetty` to the local WeTTY port over HTTPS
-
-## Docker Shape
-
-- Include WeTTY in the lab image
-- Include the `login` and PAM pieces needed for `/bin/login`
-- Run WeTTY under an init or supervisor process
-- Reverse proxy `/wetty` to the local WeTTY port over HTTPS
-
-If a specific container image cannot support `/bin/login`, the operational fallback is WeTTY SSH mode to localhost.
+- Install `openssh-server`
+- Restrict `sshd` to `127.0.0.1` and the managed `student` account
+- Install WeTTY with the managed Node runtime
+- Generate `/courseware-runtime.json` from deployment-time values
+- Start the wiki and WeTTY as separate managed services