Fly Sprite deploy target + per-user control plane

[kovtcharov]

Run the Claudia service image on a Fly Sprite as the paid tier, with a control plane that provisions one Sprite per user.

Why Sprites

Persistent KVM VMs with a 100 GB durable root filesystem, 1–2s creation, checkpoint/restore as a primitive, and auto-sleep that preserves all state while idle billing drops to cold-storage rates. That is the required behavior almost exactly: the machine sleeps when Claude finishes and wakes with worktrees, ~/.claude, and node_modules intact.

Because a Sprite is a persistent computer rather than a resetting container, it is the same deployment target as a home server. No cloud-mode branch in the code.

Architecture

One Sprite per user. Claudia stays single-tenant; the control plane is what's multi-tenant. This keeps free and paid tiers running the same image with no isolation logic inside the backend.

Scope

• Deploy path: build image → sprite CLI → running backend with volume attached
• Control plane: provision, start, stop, and destroy a Sprite per user; map account → Sprite
• Auto-sleep tuning: idle threshold, and confirmation that sleep does not break in-flight PTYs or lose task state
• Wake-on-request: a client connecting to a sleeping Sprite wakes it and connects transparently
• Public HTTPS with mandatory auth (native: require token auth for non-localhost REST requests #127/native: require token auth for non-localhost WebSocket upgrades #128) — a task-spawning API on the open internet is RCE-equivalent unauthenticated
• Per-user cost visibility (ties to feat: per-task cost & token dashboard #46)

Blocked on

The credential question in #186 — whether a user's Claude subscription may be used on infrastructure we operate. Build the deploy path regardless; it is equally required for API-key mode.

Acceptance

• The same image that runs on a home server runs on a Sprite unmodified
• A sleeping Sprite wakes on client connect with task state intact
• Idle cost per user measured and documented
• No unauthenticated route reachable from the public internet