feat(cec): tech Site door + help-card action rows; truthful Viewing chip signal

[mrjeeves]

What changed

Two commits, three user-facing fixes on the CEC technician/customer surfaces.

The manufacturer Site button finally shows for a help tech

kvmTwin gated on kvmAllowed (ours / co‑fleet / shared) — and a help technician is none of those for a customer's appliance, so the Site button (the feature's whole point) never rendered in either the help sidebar or the settings console panel. Now:

• kvmTwin authorizes either side of the tech/owner divide: ours/co‑fleet as before, or a dialed CEC customer (mirroring capabilitiesFor's isCec arm).
• Queue rows pass { raisedHand: true }, which skips the ACL entirely — the hand‑raise IS the ask, a beacon the customer deliberately lit. The KVM still authorizes the actual tunnel by its mesh roster; the gate only decides whether the button shows.

Help-sidebar cards: identity on top, an action row along the bottom

• Buttons live in one bottom row per card (Answer / Open / Reconnect + the row's doors) with room to grow; Site is a labeled 🌐 Site button, not a bare globe.
• A KVM's row offers its Site and no Chat (sidebar + settings panel both) — a KVM appliance isn't someone to chat with.
• Inline connect status: while a dial to a row is in flight ("Connecting…") or the customer's approve prompt is up ("Waiting for them to approve…"), that row's action row becomes a pulsing status line + Stop. The sidebar has no status strip like the settings panel, so the card itself says what's happening. New cecDialingNode pins the status to the row a by‑node dial targeted (those never set cecDialingNumber); cecWaitPhase() classifies the two phases.

cec://viewing — the customer learns what routes actually carry

The CEC Support app's "Viewing your screen" chip keyed on session state, but a session outlives the console by design (chat rides it) — so the chip stayed lit after the tech closed the console. The consent sweep now derives a per‑technician map of what their live routes carry (screen / control), emits cec://viewing on every change, and answers a new cec_viewing command for GUI hydrate. The sweep's is_technician early‑out is gone: the role flips permanently on first dial, so a dual‑role node (dialed once, yet also reachable as a customer) skipped consent enforcement entirely — and would have skipped this signal too. Pure technician nodes still no‑op via knows_technician.

Consumer side lands in mrjeeves/CECSupport#45 (chip keys on viewing.screen / viewing.control).

Verification

• cargo test --lib (node): 154 passed; cargo fmt --check + cargo clippy --all-targets clean.
• svelte-check: 152 files, 0 errors; pnpm build clean.
• Live flows to confirm on hardware: tech sees 🌐 Site on a raised‑hand KVM row; KVM rows show no Chat; Answer shows "Connecting…" then "Waiting for them to approve…" with a working Stop; customer's chip clears within ~2s of the tech closing the console, and never shows for chat‑only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YYdqmManehKSKxwzcfeeU4

---

Generated by Claude Code