iPhone and iPad app: the same features, served from the Frame

An iPhone can't run Python or ssh, but the Frame can. The app (ios/, SwiftUI)
connects with its own SSH key (Citadel), copies the server and helpers to
~/.cache/frame-control/<version> on the Frame once per version, starts
ui/server.py there with FRAME_LOCAL=1 on the Frame's 127.0.0.1, and shows the
page through an SSH tunnel. The server exits when the phone disconnects.

Server: FRAME_LOCAL=1 puts ui/local-bin on PATH, whose ssh stand-in runs each
`ssh frame COMMAND` locally (and serves as rsync's transport), so desktop and
phone share one code path. Android display goes through podman exec there, as
the Frame has no adb. FRAME_UI_KEY replaces the fixed X-Frame-UI value with a
per-session key. Power actions take the Developer Mode password via sudo -S.
--port 0 now prints the port it took.

Page: a bottom tab bar and safe areas on phones, Play buttons visible on touch
screens, saving through the share sheet, SSH/SFTP/Steam Link/remote desktop
opening in their iOS apps, and a password dialog for power.

App: pairing with the Developer Mode password once (never stored) or with a
key the user adds; host key pinned on first use; plain-language connection
errors with quiet retries; frame-control://install links; alerts and confirms.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/local-bin/ssh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Stand-in for ssh when Frame Control's server runs on the Frame itself
+# (FRAME_LOCAL=1, started by the iPhone app). The server and its helpers call
+# `ssh [options] frame COMMAND`, and rsync calls it as its transport; here that
+# means: run COMMAND in the home directory, as ssh would, with the same stdin.
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -[bcDEeFIiJLlmOoPpQRSWwB]) shift 2 ;;  # options that take a value
+    -?*) shift ;;
+    *) break ;;
+  esac
+done
+[ $# -gt 0 ] && shift  # the host alias
+cd "$HOME" || exit 255
+[ $# -eq 0 ] && exit 0  # -N: nothing to run
+exec "${SHELL:-/bin/sh}" -c "$*"