Jail the control-panel terminal to the customer's home (chroot)

SECURITY: the browser terminal ran an unconfined login shell as the account's
system user, so customers could browse the whole host (/var/www, other tenants,
/etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher
(/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts
ONLY that user's home into /home/jail, and chroots as the user. They can no
longer see anything outside their own home. Provisioning committed in
deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/hosting.php

@@ -1,6 +1,11 @@
 <?php
 
 return [
+    // Path to the jailed-shell launcher used by the control-panel terminal. It
+    // chroots a customer into the jailkit jail (only their own home visible).
+    // Provisioned on the host (see deployment/ladill-jailsh + sudoers).
+    'terminal_jail_launcher' => env('HOSTING_TERMINAL_JAIL_LAUNCHER', '/usr/local/sbin/ladill-jailsh'),
+
     /*
     |--------------------------------------------------------------------------
     | Central developer access