Fleet: host the node installer + daemon binaries (fix install.sh 404)

The connect-host curl one-liner 404'd because install.sh was never served. Serve
it from the frontend's public/ (Next serves it at /install.sh), and host the
daemon binaries at /dl/clawmates-node-<os>-<arch>:
- frontend/public/install.sh: detects OS/ARCH, downloads the matching binary,
  runs it (or prints from-source instructions if no prebuilt exists).
- Binaries (linux-amd64 built on tank, darwin-arm64 built locally) are baked into
  the frontend image at public/dl/ (gitignored, not committed).

Now `curl -fsSL https://clawmates.work/install.sh | bash -s -- --server … --token …`
works on linux + macOS nodes.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.gitignore

@@ -11,3 +11,6 @@ frontend/test-results
 .DS_Store
 data/
 token.key
+
+# Hosted node-agent binaries (built + baked into the frontend image, not committed)
+frontend/public/dl/

frontend/public/install.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# clawmates-node installer — served at https://<gateway>/install.sh
+#
+#   curl -fsSL <gateway>/install.sh | bash -s -- --server <gateway> --token <token>
+#
+# Downloads the daemon for your platform and runs it against your ClawMates
+# gateway with the pairing token from the "Connect a host" wizard.
+set -euo pipefail
+
+SERVER=""
+TOKEN=""
+TSKEY=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --server) SERVER="$2"; shift 2 ;;
+    --token) TOKEN="$2"; shift 2 ;;
+    --tailscale-authkey) TSKEY="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+if [[ -z "$SERVER" || -z "$TOKEN" ]]; then
+  echo "usage: install.sh --server <https://gateway> --token <token> [--tailscale-authkey <key>]" >&2
+  exit 2
+fi
+
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+case "$(uname -m)" in
+  x86_64|amd64) ARCH=amd64 ;;
+  aarch64|arm64) ARCH=arm64 ;;
+  *) ARCH="$(uname -m)" ;;
+esac
+TARGET="$OS-$ARCH"
+
+BIN_DIR="${CLAWMATES_BIN_DIR:-$HOME/.clawmates/bin}"
+BIN="$BIN_DIR/clawmates-node"
+mkdir -p "$BIN_DIR"
+
+URL="${CLAWMATES_NODE_URL:-$SERVER/dl/clawmates-node-$TARGET}"
+echo "downloading clawmates-node ($TARGET)…"
+if ! curl -fsSL "$URL" -o "$BIN"; then
+  echo "" >&2
+  echo "No prebuilt binary for $TARGET yet. Build from source (clawmates repo):" >&2
+  echo "  cargo build --release -p clawmates-node" >&2
+  echo "  ./target/release/clawmates-node --server $SERVER --token $TOKEN" >&2
+  exit 1
+fi
+chmod +x "$BIN"
+
+echo "starting clawmates-node → $SERVER"
+ARGS=(--server "$SERVER" --token "$TOKEN")
+[[ -n "$TSKEY" ]] && ARGS+=(--tailscale-authkey "$TSKEY")
+exec "$BIN" "${ARGS[@]}"