cdsr: initial import of deployed stack (runtime 4.133.0, pinned extensions, SSOT vault)

deploy/cdsr.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=code-server IDE for loca.zone (cdsr)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=loca
+Group=loca
+WorkingDirectory=/home/loca/dev/code-server
+Environment=HOME=/home/loca
+Environment=PATH=/home/loca/.local/bin:/home/loca/.bun/bin:/usr/local/bin:/usr/bin:/bin
+ExecStart=/usr/bin/code-server --config /home/loca/dev/code-server/config/config.yaml
+Restart=always
+RestartSec=5
+TimeoutStopSec=20
+# Bound the extension host on a shared box: swap was ~97% consumed before this
+# stack existed, so an unbounded editor can degrade every co-tenant service
+# before the kernel OOM-killer intervenes. Deliberately no NoNewPrivileges or
+# ProtectSystem: the documented workflow stages root-owned files with sudo from
+# the integrated terminal.
+MemoryHigh=8G
+MemoryMax=12G
+
+[Install]
+WantedBy=multi-user.target