feat(share): terminal-only sharing, bigger + full-screen — 0.25.0

Scope M12 down to a single shared-terminal mode (D23, amends D16):
- Share page rewritten terminal-only: host shares their PTY/shell; guest watches
  and may type only if the host ticks "Allow the guest to type" (read-only
  otherwise — the D9 consent exception). Terminal is larger; either side can pop
  it full-screen (Esc to exit).
- Removed the read-only stats view + HTTP server (core/share.py) and the
  `rigdoctor share serve` CLI; deleted their tests.
- Docs: D23 added; SPEC/MODULES/ROADMAP updated (M12 → done, terminal-only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/MODULES.md

@@ -18,7 +18,7 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
 | M10 | Desktop GUI | Desktop UI | **python3-pyside6** | all | P2 | ✅ |
 | M11 | Tray / menu-bar applet | Desktop UI | **python3-pyside6** (+ AppIndicator on GNOME) | all | P2 | ✅ |
 | M9 | Installer | (meta) | none | all | P1 | 🟨 |
-| M12 | Session sharing / remote assist | Sharing | none (Tier 3: tmate/sshx) | all | P3 | 🟨 |
+| M12 | Session sharing (shared terminal) | Sharing | none (relay) | all | P3 | ✅ |
 | M13 | Auto-update | (core) | none (stdlib; user-local file swap) | all | P3 | ✅ |
 | ~~M7~~ | ~~Stress / repro~~ | — | — | — | — | ❌ dropped (D7) |
 
@@ -96,12 +96,13 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
   **`.run`** (pure-Python self-extractor, `packaging/make_run.py`, built by CI). *Pending:*
   config/module selection + `systemd --user`
   service enable.
-- **M12 Session sharing / remote assist** (D16) — let a helper inspect a user's machine, in
-  an escalating ladder: (1) **diagnostic bundle export** (inventory + recent log + report,
-  one-way), (2) **live read-only view** over a user-chosen tunnel (Tailscale/cloudflared/SSH,
-  no hosted relay), (3) **gated interactive terminal** wrapping tmate/sshx (read-only by
-  default; read-write only on explicit consent — a deliberate exception to D9). Per-session
-  consent, ephemeral revocable tokens, audit log.
+- **M12 Session sharing / remote assist** (D16, scoped to terminal-only by **D23**) — a single
+  mode: a **host-consented shared terminal** over the relay. The host shares a real PTY running
+  their `$SHELL` (colors/theming preserved — fish etc.); the guest watches live and can type
+  **only if the host allows it** (otherwise read-only) — a deliberate, consent-gated exception
+  to D9. The host reads along and can type too (e.g. a sudo password, which stays local). Either
+  side can pop the terminal **full-screen**. Account-gated by the Gitea token. *The earlier
+  read-only stats view and `share serve` (Tier 1/2) were removed.*
 - **M13 Auto-update** (D18) — *check + auth implemented:* updates are **gated to Gitea account
   holders** via a Personal Access Token, stored **encrypted in the OS keyring** (`secret-tool`)
   with a 0600-file fallback (`config.load_token`/`save_token`/`token_backend`). `core/updates`