feat: boxes in the Screens list — status and remote care (MAD-811)

[madeofpendletonwool]

Summary

Boxes show up as boxes in the room's Screens list, and the room owner can look after one from their phone (ADR 0016, stage 4).

• Status on the socket. A paired display that is a Syncphony box sends its bridge's /v1/info up its room socket as box.status: version, name, temperature and throttling, uptime, last nightly update. The server keeps the latest per display in memory (no migration), rate-limited to one report per 5 s and capped at 8 KiB. It also tracks whether each display is connected. GET /rooms/{id}/displays gains online and box (BoxStatus).
• displays.updated on the room topic when a screen connects or goes away, or its box reports a change the list shows. An open Screens list refetches, and polls every 30 s while open.
• Remote care. POST /rooms/{roomId}/displays/{displayId}/reload and .../restart use the existing manage permission (owner, pairer, admin). The command goes out on the display's own topic (display:<id>), so only that display gets it. /tv hands it to boxd (/v1/reload, /v1/reboot), and a plain screen, or a box whose boxd doesn't answer, reloads the page itself. Restart is box-only (not_a_box); both need the display connected (display_offline).
• UI. "Syncphony Box 1.3 · online · 52 °C", warnings (running hot / throttled, update failed, box software older than this server expects), a Reload button and a tap-twice Restart box button. A link to the new docs/box.md ("Make a dedicated box for this TV").
• Minimum box version. MinBoxVersion = "0.2.0" in server/internal/httpapi/boxes.go, recorded in ADR 0016. A dev build's version never warns.
• OpenAPI spec updated, Go and TS regenerated.

Box side: madeofpendletonwool/syncphony-box (feat/releases-and-updates). It adds uptimeSeconds and update to /v1/info. Older boxes still work; they just report fewer fields.

Test plan

• go test -race ./internal/httpapi/ ./internal/realtime/, full go test ./..., golangci-lint
• New tests: status reaches the Screens list and online/offline tracks the socket; bad reports are ignored. Reload and restart reach only the targeted display (not other screens, members' sockets, or another room's display); a non-manager gets 403; a plain screen gets not_a_box; an offline screen gets display_offline; version comparison and report rate limits
• Web: typecheck, oxlint, vitest (all 304, including new bridge, command and Screens list helper tests)
• Look at the dialog with a real box connected

🤖 Generated with Claude Code