feat(deploy): setup-pi-kiosk.sh builds + installs the kiosk binary

Script now installs GTK/GStreamer/webkit dev libs, runs cargo build
--release as the invoking user, then drops the binary at
/opt/betterframe/kiosk/betterframe-kiosk where the systemd unit
expects it. Set SKIP_BUILD=1 to bypass when iterating.

deploy/scripts/setup-pi-kiosk.sh

@@ -8,10 +8,15 @@
 #   - Installs the betterframe-kiosk system unit + PAM stack
 #   - Enables + starts the service
 #
-# Re-run safely: every step is idempotent. The kiosk binary itself must
+# Re-run safely: every step is idempotent.
-# already be installed at /opt/betterframe/kiosk/betterframe-kiosk.
+#
+# By default the script builds the kiosk Rust binary (cargo build --release)
+# and installs it at /opt/betterframe/kiosk/betterframe-kiosk. Set
+# SKIP_BUILD=1 to skip the build step (expects the binary already present
+# at kiosk/target/release/betterframe-kiosk in the repo).
 #
 # Usage:  sudo ./deploy/scripts/setup-pi-kiosk.sh
+#         sudo SKIP_BUILD=1 ./deploy/scripts/setup-pi-kiosk.sh
 
 set -euo pipefail
 
@@ -51,6 +56,39 @@ systemctl set-default multi-user.target
 echo "==> Disabling getty on tty1 (cage owns it)"
 systemctl disable --now getty@tty1.service 2>/dev/null || true
 
+echo "==> Building + installing kiosk binary"
+BIN_SRC="${REPO_ROOT}/kiosk/target/release/betterframe-kiosk"
+BIN_DST_DIR="/opt/betterframe/kiosk"
+BIN_DST="${BIN_DST_DIR}/betterframe-kiosk"
+
+if [ "${SKIP_BUILD:-0}" != "1" ]; then
+  if ! command -v cargo >/dev/null 2>&1; then
+    echo "error: cargo not found. Install rustup or set SKIP_BUILD=1." >&2
+    exit 1
+  fi
+  apt-get install -y --no-install-recommends \
+    libgtk-4-dev libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
+    libwebkitgtk-6.0-dev pkg-config build-essential \
+    gstreamer1.0-plugins-base gstreamer1.0-plugins-good \
+    gstreamer1.0-plugins-bad gstreamer1.0-libav
+
+  # Build as the invoking user (typically the dev/admin user), not root,
+  # so cargo registry caches stay in their home.
+  BUILD_USER="${SUDO_USER:-root}"
+  echo "    building as ${BUILD_USER}"
+  sudo -u "${BUILD_USER}" cargo build --release --manifest-path "${REPO_ROOT}/kiosk/Cargo.toml"
+fi
+
+if [ ! -f "${BIN_SRC}" ]; then
+  echo "error: kiosk binary not found at ${BIN_SRC}." >&2
+  echo "       Run with SKIP_BUILD=0 (default) or build manually first." >&2
+  exit 1
+fi
+
+install -d -m 755 "${BIN_DST_DIR}"
+install -m 755 "${BIN_SRC}" "${BIN_DST}"
+echo "    installed → ${BIN_DST}"
+
 echo "==> Installing PAM stack and systemd unit"
 install -m 644 "${REPO_ROOT}/deploy/pam.d/cage" /etc/pam.d/cage
 install -m 644 "${REPO_ROOT}/deploy/systemd/betterframe-kiosk.service" \
@@ -63,12 +101,6 @@ if [ ! -e /etc/default/betterframe-kiosk ]; then
 EOF
 fi
 
-if [ ! -x /opt/betterframe/kiosk/betterframe-kiosk ]; then
-  echo "warn: /opt/betterframe/kiosk/betterframe-kiosk is missing or not executable."
-  echo "      Build the kiosk with 'cargo build --release' and copy the binary there"
-  echo "      before starting the service."
-fi
-
 systemctl daemon-reload
 systemctl enable betterframe-kiosk.service