feat: deep-link OpenCode portal card to the /home/opencode workspace

[xnoto]

Summary

Point the OpenCode portal card at the project-scoped deep link instead of the bare host, so a fresh browser session lands directly in the shared /home/opencode workspace without manually adding the project in the web UI.

The path segment is the base64url encoding of /home/opencode (L2hvbWVvb3BlbmNvZGU), verified against the OpenCode web app router at tag v1.18.23 (the deployed chart version): the /:dir/session/:id? route decodes the directory from the URL, boots the project workspace, and fires the same project/current registration call the "Add Project" picker uses. First visit in a fresh browser prompts for the existing server credentials (HTTP Basic) and then opens the workspace directly.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited

PR CI passed: static-checks (pre-commit hooks + node --check of the untouched service worker) — success. The second checkbox is not applicable — no generated or centrally distributed files are in scope. Functional behavior (deep link resolving to the workspace) is verifiable only in production after merge and is called out below.

Impact and rollout

Self-contained www change: one href on the OpenCode card in makeitwork.cloud/index.html. No chart, GitOps, infrastructure, or route changes. On merge, the existing main workflow deploys to S3 and purges the Cloudflare cache automatically; after that, verify by opening the portal link in a fresh browser (expect the Basic auth prompt, then the /home/opencode workspace). Maintenance note: the URL format is an OpenCode v1.18.x web-app contract; if a future opencode-server chart upgrade changes the route encoding, this link must be updated in step.

This change was materially produced by an AI agent (OpenCode, at the owner's direction); the deep-link format was verified against upstream source at anomalyco/opencode tag v1.18.23.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — fully reversible by reverting the commit; the portal card continues to target the same host