Fix bookmarks menu dismiss, home Email URL, and deploy hygiene.

Close the hamburger panel on outside click/focus via X11 (xinput/xdotool)
without a fullscreen overlay; point home Email to Roundcube; sync
home-screen-index.html in deploy/install; remove credentials.md from git
and document private LAN-only Gitea usage.

Co-authored-by: Cursor <cursoragent@cursor.com>

CLAUDE.md

@@ -58,15 +58,21 @@ sleep 1
 |------|---------|
 | `browser.py` | Main application — toolbar + CDP + Chromium launcher |
 | `bookmarks.json` | Nested bookmark structure |
+| `home-screen-index.html` | Home screen source (deploy copies to `/home/jgitta/kiosk-home/index.html`) |
 | `deploy.sh` | One-command deploy |
-| `/home/jgitta/kiosk-home/index.html` | Senior home screen |
+| `/home/jgitta/kiosk-home/index.html` | Senior home screen (live copy, outside repo) |
 | `~/.config/openbox/autostart` | Auto-restart loop on crash |
 | `/usr/local/bin/kiosk-restart` | Safe restart (kills Chromium + Python) |
 | `/etc/X11/xorg.conf.d/50-kiosk-hardening.conf` | Blocks TTY switching |
 
-## Gitea repo
+## Gitea repo (private LAN only)
 
-`https://gitea.jgitta.com/jgitta/senior-kiosk` — master branch
+- **URL**: `git@gitea.jgitta.com:jgitta/senior-kiosk.git` (SSH) or `https://gitea.jgitta.com/jgitta/senior-kiosk.git` (HTTPS)
+- **Branch**: `master`
+- **Exposure**: Internal only — `gitea.jgitta.com` resolves on LAN/VPN (Caddy at 192.168.88.110). Not public internet.
+- **Auth**: SSH key preferred (`git@gitea.jgitta.com:jgitta/senior-kiosk.git`) once the machine’s public key is in Gitea → Settings → SSH Keys. Until then use HTTPS without a token in the URL and `git config credential.helper store`. Rotate any token that was ever in a remote URL.
+- **Deploy**: `bash deploy.sh "message"` — push to Gitea, sync home screen, `kiosk-restart`; production via SSH on 192.168.88.x / Tailscale.
+- **Secrets**: `credentials.md` is gitignored; Roundcube passwords live on the mail server, not in this repo.
 
 ## Roundcube webmail