v0.0.2 - spinning out n_signer

plans/tui_login.md

@@ -185,6 +185,10 @@ stack/nostr-id-tui/                  # new subtree
 │   ├── screen_generate.c            # generate + display + 3-position confirm
 │   ├── screen_import.c              # /media/*/mnemonic.txt discovery + wipe
 │   ├── screen_bunker.c              # NIP-46 bunker URL entry
+│   ├── screen_services.c            # post-identity service selection menu
+│   ├── screen_services_confirm.c    # commit/apply status + failure handling
+│   ├── services_conf.c              # /etc/n-os-tr/services.conf parser
+│   ├── systemd_client.c             # wrapper over /bin/systemctl and journalctl
 │   ├── screen_error.c               # fatal error screen
 │   ├── curses_helpers.c             # small ncurses wrappers (input w/o history)
 │   ├── agent_client.c               # speak nostr-id control socket (see §5)
@@ -237,9 +241,12 @@ stateDiagram-v2
 
     Amnesia --> SendAgentAmnesia
 
-    SendAgent --> Exit: agent returns ok
+    SendAgent --> Services: agent returns ok
     SendAgent --> FatalError: agent returns error
-    SendAgentAmnesia --> Exit
+    SendAgentAmnesia --> Services
+
+    Services --> Exit: commit/skip complete
+    Services --> FatalError: unrecoverable apply error
 
     FatalError --> [*]
     Exit --> [*]
@@ -261,7 +268,9 @@ stateDiagram-v2
 
 **Amnesia.** No persistence, no Nostr config projection, ephemeral main key generated via [`nostr_generate_keypair`](../includes/nostr_core_lib/nostr_core/nip006.h:20). Big red banner: "AMNESIA MODE. This identity dies at shutdown."
 
-**FatalError.** A single full-screen error. No recovery — require the user to reboot. This is only reached if ncurses init failed, the agent control socket is unavailable, or memory locking failed (which means the threat-model invariants cannot be enforced).
+**Services.** After identity load succeeds, the same TUI presents a service-selection screen (see [`plans/tui_service_menu.md`](tui_service_menu.md)). The user toggles optional services (c-relay, ginxsom, fips, nginx, config-loader, config-writer, ssh, tor) and either commits changes or skips with all services off for that session.
+
+**FatalError.** A single full-screen error. No recovery — require the user to reboot. This is only reached if ncurses init failed, the agent control socket is unavailable, memory locking failed (which means the threat-model invariants cannot be enforced), or service-apply hits a non-recoverable system state.
 
 ### 3.3 Anti-shoulder-surf tradeoffs
 
@@ -408,6 +417,9 @@ sequenceDiagram
     Note over TUI: user interacts
     TUI->>IA: load_mnemonic / load_bunker / load_amnesia
     IA-->>TUI: ok
+    Note over TUI: service selection menu (same binary)
+    TUI->>SD: start/stop selected units
+    SD-->>TUI: unit results
     TUI->>SD: exit 0
     SD->>GT: start (now allowed by ordering)
     GT->>User: "n-os-tr login:"