Agent computer: terminal (tmux + drives + tabs), Obsidian vault, UI polish

Terminal app (xterm ⇄ WebSocket ⇄ per-agent themed container):
- zsh + oh-my-zsh + powerlevel10k image (agent-terminal), runs as uid 65532 to
  share read-write ownership of the file-drive volume with the server.
- Interactive PTY in cm-sandbox (bollard exec tty/attach + resize) + a
  TerminalManager; ticket-authed WS bridge routed straight to the backend via a
  Traefik PathRegexp(/ws) rule. MOTD greets the user by name.
- tmux resumable sessions; multi-tab (one tmux session per tab, same container),
  drag-to-reorder, rename, and a Save that persists named tabs to the server
  (terminal_tabs, migration 0014) so they survive logout / a new device.
- Files drives mounted per-agent (subpath) at ~/drives/{documents,received,
  shared}; a reconciler keeps the Files app's index in sync with terminal writes.
  Storage moved to a shared `filedata` volume (CLAWMATES_STORAGE__DATA_DIR).

Obsidian vault (a markdown "second brain" per agent):
- New `vault` FileDrive (migration 0015) mounted into the terminal at ~/obsidian;
  a file-content read route; a purple Obsidian tile + a vault viewer app.

Computer UI:
- Draggable computer-panel width (min = phone preset) keeping the size presets.
- Green Terminal glyph, "Claw Chat" → "Chat", colored gradient-outline app icons.
- Agent page: avatar↔activity-grid spacing + larger, uniform section fonts with
  colored section-tinted tag chips.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-config/src/lib.rs

@@ -174,6 +174,26 @@ pub struct SandboxConfig {
     pub enabled: bool,
     /// Pre-provisioned sandboxes kept ready (0 = provision on demand).
     pub warm_pool: usize,
+    /// Themed image for the interactive Terminal computer app
+    /// (zsh + oh-my-zsh + powerlevel10k).
+    #[serde(default = "default_terminal_image")]
+    pub terminal_image: String,
+    /// Give terminal containers network egress (a networked dev shell). Off by
+    /// default — the safe, isolated posture.
+    #[serde(default)]
+    pub terminal_egress: bool,
+    /// The named Docker volume holding the file-drive blobs, mounted (per-agent
+    /// subpath) into the Terminal at ~/drives. Must match the compose volume.
+    #[serde(default = "default_terminal_drive_volume")]
+    pub terminal_drive_volume: String,
+}
+
+fn default_terminal_image() -> String {
+    "clawmates/agent-terminal:dev".into()
+}
+
+fn default_terminal_drive_volume() -> String {
+    "clawmates_filedata".into()
 }
 
 impl Default for SandboxConfig {
@@ -183,6 +203,9 @@ impl Default for SandboxConfig {
             browser_image: "clawmates/agent-browser:dev".into(),
             enabled: true,
             warm_pool: 0,
+            terminal_image: default_terminal_image(),
+            terminal_egress: false,
+            terminal_drive_volume: default_terminal_drive_volume(),
         }
     }
 }