feat(booth): kept boards — a .forever sentinel and a standing link board

Agent sessions hand the operator URLs and they drown in terminal
scrollback. The Booth is the right home for them — it already has the one
property that decides adoption, which is that a session can publish with
mkdir and cp, no API key, no schema, no deploy — but everything in it dies
in 24h.

So: a booth containing `.forever` is never swept, and renders in its own
Kept lane at the top of the index. Opt-in per booth, so the ephemeral
default is untouched and nobody inherits a cleanup chore. `rm` the
sentinel and the board rejoins the sweep; the CLI verbs are sugar over
exactly that, which keeps the filesystem-is-the-state model honest.

The pin is deliberately NOT wired into is_expired(). That stays a pure age
question feeding the `expires_in` countdown; only sweep_once() honours the
sentinel. Keeping expiry arithmetic and reaper policy apart means they
cannot drift into each other.

Kept cards are visually separated per Australis: a 2px top edge in aurora
blue, the one accent border the system sanctions. They show "kept" instead
of a countdown, and they deliberately lose the one-click wipe button — a ×
next to the durable stuff is a footgun, so removing a kept board is a
two-step act.

`booth link <url> [description]` appends to the standing `links` board,
creating and keeping it on first use. Entries carry provenance (handle or
hostname, plus a timestamp) because a bare URL is unreadable three days
later. The append is one printf of one line to an O_APPEND fd — atomic
under PIPE_BUF on POSIX — which matters because many agents post to one
board and interleaved half-lines would be the obvious failure mode.

Seven tests cover the sentinel: detection, survival of a sweep that wipes
its neighbour, the deliberate is_expired/sweep_once split, the listing
flag, the sentinel not inflating item counts, and both lane-rendering
directions. Two of them originally asserted on the bare strings "Kept" and
"kept-grid", which passed for the wrong reason — those also appear in the
inlined stylesheet served on every page — so they now assert the full
class attribute. 55 pass.

Also corrects the Homepage card's description, which advertised a flat 24h
TTL that is no longer the whole story.

booth/app.py

@@ -10,6 +10,12 @@ Model (deliberately dead-simple, no database):
   * 24h TTL: a background sweeper wipes any booth untouched for TTL hours. A booth's
     age is measured from the *newest* mtime in its tree, so it lives while it's being
     worked on and self-destructs TTL hours after the last activity.
+  * KEPT BOOTHS: a booth containing the KEEP_MARKER dotfile (`.forever`) is exempt
+    from the sweep and renders in its own lane above the ephemeral grid. That is the
+    home for durable operator-facing boards — chiefly the standing link board agent
+    sessions post to, whose whole purpose is to survive longer than the scrollback
+    it replaces. Opt-in per booth, so the ephemeral default is unchanged and nobody
+    inherits a cleanup chore; `rm` the sentinel and the booth rejoins the sweep.
 
 State is the filesystem — `ls ~/booth-data` tells you everything. That is the whole point.
 """
@@ -57,6 +63,13 @@ MARKDOWN_EXTS = {".md", ".markdown", ".mdown"}
 TEXT_EXTS = {".txt", ".text", ".log"}
 DOC_MAX_BYTES = 2 * 1024 * 1024  # above this, a doc is handed back raw, not rendered
 
+# Sentinel dotfile that exempts a booth from the TTL sweep — see the "kept
+# booths" note in the module docstring. A dotfile because the existing listing
+# code already skips dotfiles, so it costs nothing in item counts or galleries,
+# and because `touch`/`rm` is the entire user interface: no flag to remember, no
+# state anywhere but the filesystem.
+KEEP_MARKER = ".forever"
+
 
 def doc_kind(name: str) -> str | None:
     """'markdown' | 'text' | None — a booth file viewable as a readable page."""
@@ -135,14 +148,30 @@ def booth_age_seconds(path: Path, now: float | None = None) -> float:
 
 
 def is_expired(path: Path, ttl_seconds: float, now: float | None = None) -> bool:
+    """Pure age question. Deliberately does NOT consider the keep sentinel.
+
+    Expiry arithmetic (what `expires_in` renders) and reaper policy (what
+    actually gets deleted) are kept apart so they cannot drift into each other.
+    Only `sweep_once` honours the pin.
+    """
     return booth_age_seconds(path, now) > ttl_seconds
 
 
+def is_kept(path: Path) -> bool:
+    """True if this booth carries the keep sentinel and must never be swept."""
+    return (path / KEEP_MARKER).exists()
+
+
 def sweep_once(data_dir: Path, ttl_seconds: float, now: float | None = None) -> list[str]:
     """Wipe every direct-child booth older than the TTL. Returns names wiped.
 
     Only ever removes direct children of data_dir (never data_dir itself), and
     skips dotfolders so a stray control dir can opt out.
+
+    A booth carrying KEEP_MARKER is exempt no matter how stale it is. That is
+    the one escape hatch from the 24h contract, and it is opt-in per booth: the
+    default stays ephemeral, so nobody inherits a cleanup chore they did not ask
+    for. Removing the sentinel hands the booth straight back to the sweeper.
     """
     wiped: list[str] = []
     if not data_dir.is_dir():
@@ -151,6 +180,8 @@ def sweep_once(data_dir: Path, ttl_seconds: float, now: float | None = None) ->
         if not child.is_dir() or child.name.startswith("."):
             continue
         try:
+            if is_kept(child):
+                continue
             if is_expired(child, ttl_seconds, now):
                 shutil.rmtree(child)
                 wiped.append(child.name)
@@ -185,6 +216,7 @@ def list_booths(data_dir: Path, ttl_seconds: float, now: float | None = None) ->
                 "thumb_url": thumb_url,
                 "has_index": (child / "index.html").is_file(),
                 "uploaded": (child / UPLOAD_MARKER).exists(),
+                "kept": is_kept(child),
                 "expires_in": max(0.0, ttl_seconds - (now - mtime)),
                 "mtime": mtime,
             }
@@ -454,7 +486,12 @@ def create_app(
     app = FastAPI(title="The Booth", lifespan=lifespan)
 
     ttl_display = int(ttl_hours) if float(ttl_hours).is_integer() else ttl_hours
-    base_ctx = {"ttl_hours": ttl_display, "host": host_label, "data_dir": str(data_dir)}
+    base_ctx = {
+        "ttl_hours": ttl_display,
+        "host": host_label,
+        "data_dir": str(data_dir),
+        "keep_marker": KEEP_MARKER,  # shown in the kept lane so the mechanism is discoverable
+    }
 
     def resolve_booth(name: str) -> Path:
         if not name or name.startswith(".") or "/" in name or "\\" in name or ".." in name:
@@ -471,8 +508,20 @@ def create_app(
 
     @app.get("/", response_class=HTMLResponse)
     def index(request: Request):
+        # Two lanes, split here rather than in the template: kept boards are a
+        # different KIND of thing from the ephemeral churn — durable, deliberate,
+        # operator-facing — and burying them in a feed that turns over daily is
+        # exactly how they would get lost, which is the problem they exist to
+        # solve. Kept renders first.
+        everything = list_booths(data_dir, ttl_seconds)
         return templates.TemplateResponse(
-            request, "index.html", {**base_ctx, "booths": list_booths(data_dir, ttl_seconds)}
+            request,
+            "index.html",
+            {
+                **base_ctx,
+                "kept": [b for b in everything if b["kept"]],
+                "booths": [b for b in everything if not b["kept"]],
+            },
         )
 
     @app.get("/healthz")