RDM card reader: print card events, select the right port, serve taps to a web app

Card reading (rdm6300 + pyserial) printing card inserted/removed with the
full card data, plus a --serve mode that publishes taps over HTTP so a web
page can authenticate a tap.

The bridge reports card ids only - mapping a card to a user stays on the
server. The tap is latched for --tap-ttl seconds, including after the card is
lifted, and is single use, so a page reload cannot replay one tap into two
logins.

Port selection identifies the reader by serial number or by-id path instead of
/dev/ttyUSBn, and refuses to guess when a selector matches several adapters.

deploy/ has the systemd unit, a udev rule for a stable /dev/rdm-reader, and
install.sh. Covered by unit tests plus PTY end-to-end tests.

deploy/rdm-card-reader.service

@@ -0,0 +1,53 @@
+[Unit]
+Description=RDM card reader HTTP bridge (serves card taps for web login)
+Documentation=file:/opt/rdm-card-reader/README.md
+# The serial device must exist before we start, otherwise the reader opens the
+# wrong tty or none at all.
+After=dev-serial.device network-online.target
+Wants=network-online.target
+
+# Do not restart forever if the reader is genuinely absent. These are [Unit]
+# options, not [Service] - systemd ignores them in the wrong section.
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=simple
+User=rdmcard
+Group=dialout
+WorkingDirectory=/opt/rdm-card-reader
+
+# --serve exposes the card on http://127.0.0.1:8765/api/card
+# Autodetect refuses to guess if more than one USB adapter is present, which is
+# the safe behaviour: a wrong guess means authenticating the wrong person.
+ExecStart=/opt/rdm-card-reader/.venv/bin/rdm-card-reader \
+    --serve \
+    --port /dev/rdm-reader \
+    --mode login \
+    --allow-origin https://your.web.app
+
+Restart=always
+RestartSec=3
+
+# The bridge only needs to read the serial port and listen on loopback.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+DeviceAllow=/dev/rdm-reader rw
+DevicePolicy=closed
+
+# stdout/stderr go here; watch with: journalctl -u rdm-card-reader -f
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=rdm-card-reader
+
+[Install]
+WantedBy=multi-user.target