feat: run the aoe web dashboard as a service

Auth is off in the unit: traefik + authelia front it, and aoe rejects
--auth none on a wildcard bind unless --behind-proxy says so.

home/yolo/services.nix

@@ -15,6 +15,8 @@ let
   toolPath = "%h/.local/bin:%h/.nix-profile/bin:/etc/profiles/per-user/naps62/bin:/run/current-system/sw/bin";
 
   sem = inputs.sem.packages.${pkgs.system}.default;
+
+  aoe = inputs.agent-of-empires.packages.${pkgs.system}.aoe-with-web;
 in
 {
   home.packages = [
@@ -70,6 +72,27 @@ in
       Install.WantedBy = [ "default.target" ];
     };
 
+    aoe-web = {
+      Unit = {
+        Description = "aoe serve — Agent of Empires web dashboard";
+        After = [ "network.target" ];
+        # Same restart-budget trap as `rev` above.
+        StartLimitIntervalSec = 0;
+      };
+      Service = {
+        Type = "simple";
+        WorkingDirectory = "%h";
+        # aoe refuses `--auth none` on a non-loopback bind unless --behind-proxy
+        # is set; --allowed-host is what makes the rebinding gate accept a
+        # hostname under a wildcard bind (an IP literal needs no flag).
+        ExecStart = "${aoe}/bin/aoe serve --host 0.0.0.0 --port 8080 --auth none --behind-proxy --allowed-host aoe.n62.casa";
+        Environment = [ "PATH=${toolPath}" ];
+        Restart = "always";
+        RestartSec = 2;
+      };
+      Install.WantedBy = [ "default.target" ];
+    };
+
     hourlog = {
       Unit = {
         Description = "Start the Friday hour log in a tmux session";