Initial commit: KiddOs v3 React kiosk

- React 18 + Vite 5 hot-reload OS (800x480 Nord theme)
- 7 apps: Journal, Calculator, Drawing, CodeLab, Clock, Files, Scratch
- Cage + Cog Wayland kiosk, offline localStorage
- Scripts: dev.sh, run-kiosk.sh, run-prod.sh

scripts/run-kiosk.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Proven kiosk - LOCALHOST ONLY per safety boundary
+set -e
+MODE="${1:-dev}" # dev | prod | hello (hello only for local file test)
+URL="http://localhost:5173"
+BG="#2E3440"
+
+if [ "$MODE" = "prod" ]; then
+  URL="file:///home/elias/KiddOsV3/webapp/dist/index.html"
+elif [ "$MODE" = "hello" ]; then
+  URL="file:///home/elias/KiddOsV2/browser/hello.html"
+fi
+
+# Safety check: only allow localhost or file://
+if [[ "$URL" != http://localhost* && "$URL" != http://127.0.0.1* && "$URL" != file://* ]]; then
+  echo "❌ Blocked: Only localhost:5173 or file:// allowed per parent boundary! Tried: $URL"
+  exit 1
+fi
+
+echo "🔒 KiddOs v3 kiosk — localhost/file only"
+echo "   URL: $URL (allowed)"
+echo "   BG: $BG"
+echo "   Stopping old v2/v1 kiosks..."
+sudo systemctl stop kiddos.service kiddos-browser.service journal-kiosk.service kiddos-v3.service 2>/dev/null || true
+sudo pkill -9 cage cog 2>/dev/null || true
+sudo rm -f /run/user/1000/wayland-* 2>/dev/null || true
+sleep 1
+
+if [ "$MODE" = "dev" ]; then
+  if ! curl -s --connect-timeout 2 http://localhost:5173/ | grep -q "KiddOs" ; then
+    echo "⚠️  Vite dev server not running on :5173!"
+    echo "   Start in another SSH: cd ~/KiddOsV3/webapp && npm run dev"
+    echo "   Falling back to prod file://"
+    URL="file:///home/elias/KiddOsV3/webapp/dist/index.html"
+  fi
+fi
+
+echo "   Starting: cage -s -- cog --platform=wl $URL"
+sudo openvt -f -c 1 -s -- env XDG_RUNTIME_DIR=/run/user/1000 cage -s -- cog --platform=wl "$URL" --bg-color="$BG"