fix(rpi400): ship auth runtime deps + wire --kiosk through CI

secubox-auth/users crash at import on the rpi400 image because it is built
with `dpkg -i --force-depends` + debootstrap --include, so their declared
Depends (python3-argon2, python3-pyotp, python3-qrcode) are never pulled —
unlike normal apt installs on mochabin. The engine does `from argon2 import
...` / `import pyotp` / `import qrcode`, so the daemon dies at startup →
nginx 502 → no login. Add pyotp+qrcode (pure-Python) to INCLUDE_PKGS and
argon2 via the QEMU-proven pip step (mirroring the cryptography exclusion).

Also expose the kiosk GUI through CI: a `kiosk` workflow_dispatch boolean
→ build-image.sh --kiosk → forwarded to build-rpi-usb.sh, so a rebuilt
rpi400 image can ship the chromium fullscreen dashboard.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>

.github/workflows/build-image.yml

@@ -35,6 +35,11 @@ on:
         description: 'Image size (empty = use board default)'
         required: false
         default: ''
+      kiosk:
+        description: 'rpi400/rpi4 only: include GUI kiosk (chromium fullscreen dashboard)'
+        required: false
+        type: boolean
+        default: false
   push:
     tags:
       - 'v*'
@@ -126,12 +131,20 @@ jobs:
             SIZE_OPT="--size ${{ inputs.size || github.event.inputs.size }}"
           fi
 
+          # rpi400/rpi4 GUI kiosk (chromium fullscreen dashboard). Ignored by
+          # non-rpi boards (build-image.sh only forwards it to build-rpi-usb.sh).
+          KIOSK_OPT=""
+          if [ "${{ inputs.kiosk || github.event.inputs.kiosk }}" = "true" ]; then
+            KIOSK_OPT="--kiosk"
+          fi
+
           sudo -E bash image/build-image.sh \
             --board ${{ matrix.board }} \
             --suite ${{ env.DEBIAN_SUITE }} \
             --out output/ \
             $SIZE_OPT \
-            $SLIPSTREAM_OPT
+            $SLIPSTREAM_OPT \
+            $KIOSK_OPT
           sudo chown -R $(id -u):$(id -g) output/
         timeout-minutes: 90
 

image/build-image.sh

@@ -77,6 +77,7 @@ while [[ $# -gt 0 ]]; do
     --local-cache) USE_LOCAL_CACHE=1;  shift   ;;
     --slipstream)  SLIPSTREAM_DEBS=1;  shift   ;;
     --keep-rootfs) KEEP_ROOTFS=1;      shift   ;;
+    --kiosk)       INCLUDE_KIOSK=1;    shift   ;;
     --help|-h)     usage ;;
     *) err "Argument inconnu: $1" ;;
   esac
@@ -95,7 +96,8 @@ source "${BOARD_DIR}/config.mk" 2>/dev/null || true
 if [[ "${USE_RPI_SCRIPT:-0}" == "1" ]] || [[ "$BOARD" == "rpi400" ]] || [[ "$BOARD" == "rpi4" ]]; then
   log "Raspberry Pi board detected - using build-rpi-usb.sh"
   RPI_ARGS="--out ${OUT_DIR}"
-  [[ $SLIPSTREAM_DEBS -eq 1 ]] && RPI_ARGS="$RPI_ARGS --slipstream"
+  [[ ${SLIPSTREAM_DEBS:-0} -eq 1 ]] && RPI_ARGS="$RPI_ARGS --slipstream"
+  [[ ${INCLUDE_KIOSK:-0} -eq 1 ]] && RPI_ARGS="$RPI_ARGS --kiosk"
   exec bash "${SCRIPT_DIR}/build-rpi-usb.sh" $RPI_ARGS
 fi
 

image/build-rpi-usb.sh

@@ -135,6 +135,10 @@ INCLUDE_PKGS+=",python3-fastapi,python3-uvicorn,python3-httpx,python3-psutil"
 INCLUDE_PKGS+=",python3-aiosqlite,python3-jinja2,python3-jwt"
 INCLUDE_PKGS+=",python3-aiofiles,python3-pil,python3-tomli,python3-pydantic"
 INCLUDE_PKGS+=",python3-jose,python3-toml,python3-netifaces"
+# Auth/users engine runtime deps — WITHOUT these secubox-auth crashes at import
+# (import pyotp / import qrcode) → nginx 502 → no login. Pure-Python, apt-safe.
+# argon2 (compiled cffi) goes via the pip step below, mirroring cryptography.
+INCLUDE_PKGS+=",python3-pyotp,python3-qrcode"
 
 # Network and security tools
 INCLUDE_PKGS+=",bridge-utils,dnsutils,iputils-arping,avahi-daemon,avahi-utils"
@@ -679,7 +683,7 @@ log "Installing Python dependencies via pip..."
 chroot "${ROOTFS}" pip3 install --break-system-packages -q \
   fastapi uvicorn[standard] python-jose[cryptography] httpx \
   jinja2 tomli toml pyroute2 psutil pydantic \
-  aiofiles aiosqlite authlib cryptography \
+  aiofiles aiosqlite authlib cryptography argon2-cffi \
   python-multipart websockets netifaces email-validator \
   2>&1 | tail -10 || true
 ok "Python dependencies installed"