Summary

• Add a confirmed “Shut down Codeman” action for desktop and tablet headers.
• Require CODEMAN_PASSWORD authentication in single-user mode and an administrator in multi-user mode.
• Stop the owning systemd/launchd supervisor when one is verified; otherwise use the existing graceful server stop path.
• Preserve tmux sessions so they can be recovered after restart.
• Stop reconnect loops after an accepted shutdown and keep terminal keyboard focus out of the confirmation dialog.

Security model

The route fails closed in three places:

1. Passwordless single-user network access receives 403.
2. Non-admin multi-user accounts receive 403.
3. Supervisor shutdown is accepted only when the detected Codeman unit/job reports the current process as its owner. Nested previews cannot stop a parent service.

System-level supervisor actions also fail closed when administrator access is unavailable.

Scope

This is the secure instance-shutdown slice extracted from #173. It includes the orchestration port, supervisor detection, route, confirmation UI, header policy, documentation, and focused tests. It does not depend on the mobile terminal controls.

The destructive header action stays hidden on phone widths, including wide-phone touch layouts through 480px.

Validation

• npx vitest run --config config/vitest.config.ts test/instance-shutdown.test.ts test/routes/system-routes.test.ts test/mobile-header-buttons-policy.test.ts: 82 passed
• npx vitest run --config test/mobile/vitest.config.ts test/mobile/header-buttons.test.ts: 4 passed
• npm run check:frontend-syntax: 26 files passed
• npm run build: passed
• Commit formatting hook: passed
• git diff --check: passed