k8s/aux: add cert-manager longhorn dashboard forge dev-tools and shadowsocks

- cert-manager ClusterIssuers (LetsEncrypt + homelab-ca)
- Longhorn storage dashboard
- Portainer dashboard config
- Forgejo git service
- Claude terminal remote access
- Shadowsocks tunnel for remote access

k8s/dev-tools/README.md

@@ -0,0 +1,49 @@
+# Claude Terminal — Persistent Remote Dev Environment
+
+Runs Claude CLI in a persistent tmux session with web-based terminal access via gotty.
+
+## Building the Image
+
+Build for `linux/amd64`:
+
+```bash
+cd homelab
+docker buildx build --platform linux/amd64 \
+  -t forgejo.riotpiao.homelab.com/rock/claude-terminal:latest \
+  -f k8s/dev-tools/Dockerfile \
+  k8s/dev-tools
+
+# Log in to Forgejo registry
+docker login forgejo.riotpiao.homelab.com \
+  --username ci-bot \
+  --password "$(talos get cluster/iam/agents/ci-bot --key token)"
+
+# Push
+docker push forgejo.riotpiao.homelab.com/rock/claude-terminal:latest
+```
+
+Or use the provided build script:
+
+```bash
+./k8s/dev-tools/build.sh
+```
+
+## Deployment
+
+Update `values.yaml` if needed, then deploy via helmfile:
+
+```bash
+helmfile apply -l name=claude-terminal
+```
+
+Access the terminal at: **https://claude.riotpiao.homelab.com**
+
+## Persistent Storage
+
+- All Claude configuration stored in `/root/.claude` (persistent PVC, 10Gi Longhorn)
+- Survives pod restarts and node reboots
+- Accessible immediately after reconnecting
+
+## SSH Access (Optional)
+
+To add SSH access, extend the Dockerfile to include openssh-server and mount the PVC as home directory.