Replace the Python CLI with a Node CLI, add a systemd service command

The app is already 100% Node, so the Python launcher was pure overhead - it
existed mainly to bootstrap Node, which is circular. The CLI is now merged
into app/ (the single published npm package): `triggershell start` validates
the config and imports server.ts directly in-process, so server.ts's own
SIGTERM/SIGINT handling just works with no signal-relay/child-process layer
needed. `dev` is dropped from the public CLI (contributors use `pnpm --dir
app dev` directly); there's no `build` command either, since the package
ships a prebuilt `.next` via a `prepack` hook. Adds `triggershell service
install|uninstall|status` for running as a per-user or system systemd unit.

Also fixes two bugs found while wiring this up: server.ts resolved `.next`
relative to `process.cwd()`, which broke once the CLI could run from a
directory other than the app itself; and an explicitly-`files`-listed
package directory bypasses .npmignore for its subpaths, so `.next/cache`
was inflating the npm tarball to ~670MB (now stripped in `prepack`, ~7MB).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -24,20 +24,22 @@ API for automation.
 ## Quickstart
 
 ```bash
-pip install triggershell         # or: pip install -e . from a checkout
+npm install -g triggershell      # or: npx triggershell <command> for one-off use
 triggershell init                # scaffold triggershell.yml (+ .env for secrets) in the current directory
 triggershell users add admin     # create a login (skip if you set auth.enabled: false)
-triggershell dev                 # start in dev mode and open the browser
+triggershell start               # start the app and open the browser
 ```
 
-Edit `triggershell.yml` to add your own scripts (see [Configuration](#configuration) below),
-then run `triggershell start` for a production build.
+Edit `triggershell.yml` to add your own scripts (see [Configuration](#configuration) below), then
+re-run `triggershell start`.
+
+> The `triggershell` package isn't published to npm yet. Until it is, build and link a local copy
+> instead: `pnpm --dir app install && pnpm --dir app build && pnpm --dir app link --global`.
 
 ## Requirements
 
-- Python >= 3.9
-- Node.js >= 20 (checked by the CLI; not auto-installed)
-- pnpm (auto-provisioned via Corepack if missing and Corepack is available)
+- Node.js >= 20 — the only thing you need installed. Everything else `triggershell` needs ships
+  inside the package itself and is resolved automatically when you install it.
 
 ## Configuration
 
@@ -100,12 +102,14 @@ the script — always as a discrete argv element or env var, never interpolated
 | Command | Description |
 |---|---|
 | `triggershell init [PATH]` | Scaffold a new config file + `.env` (`--port`, `--auth/--no-auth`, `--force`) |
-| `triggershell validate [-c CONFIG]` | Validate a config file (fast Python pre-flight + full Node/Zod schema) |
-| `triggershell dev [-c CONFIG] [--port] [--host] [--no-browser]` | Run in development mode (hot reload) |
-| `triggershell start [-c CONFIG] [--port] [--host] [--no-browser] [--skip-build]` | Build (if stale) and run in production mode |
-| `triggershell doctor` | Print environment/config diagnostics |
+| `triggershell validate [-c CONFIG]` | Validate a config file against the full schema |
+| `triggershell start [-c CONFIG] [--port] [--host] [--no-browser]` | Run the web app |
+| `triggershell doctor [-c CONFIG]` | Print environment/config diagnostics |
 | `triggershell users add <username> [-c CONFIG] [--inline]` | Hash a password, store it in `.env`, and print a `${VAR}` snippet for `auth.users` (`--inline` prints the raw hash instead) |
 | `triggershell users add-token <name> [-c CONFIG] [--inline]` | Generate an API token, store its hash in `.env`, and print a `${VAR}` snippet for `auth.tokens` (`--inline` prints the raw hash instead) |
+| `triggershell service install [--system]` | Install a systemd unit that runs `triggershell start` (per-user by default, Linux only) |
+| `triggershell service uninstall [--system]` | Stop, disable, and remove the systemd unit |
+| `triggershell service status [--system]` | Show the systemd unit's status |
 
 ## Web App Guide
 
@@ -145,19 +149,22 @@ Full reference with request/response shapes and curl examples: [`docs/API.md`](d
 
 ## Development
 
+This is the workflow for working on TriggerShell itself, not for installing/running it — it
+bypasses the CLI entirely and talks to `app/`'s own scripts directly, with hot reload:
+
 ```bash
 pnpm --dir app install
-pnpm --dir app dev            # or: triggershell dev, which wraps this
+pnpm --dir app dev            # tsx watch server.ts - reads TRIGGERSHELL_CONFIG_PATH from the environment
 pnpm --dir app lint
 pnpm --dir app typecheck
+pnpm --dir app test           # CLI unit tests (src/cli/**/*.test.ts)
 pnpm --dir app db:studio      # browse the SQLite DB
 ```
 
 Repo layout:
 
 ```
-triggershell/    Python CLI (launcher/orchestrator only)
-app/             Next.js app - all server logic (API, auth, script execution) lives here
+app/             The published npm package: Next.js app + the `triggershell` CLI (bin/, src/cli/) in one
 examples/        A runnable example config + scripts
 docs/            Config/architecture/API reference docs
 ```