Adding desktop shortcuts for WROLPi services + trust-on-login autostart.

Five Type=Link launchers drop on /home/wrolpi/Desktop/ via the chroot
hook:

  WROLPi              https://localhost/             /opt/wrolpi/icon.png
  WROLPi Controller   https://localhost/controller/  controller-logo.png
  WROLPi Help         https://localhost:8086/        help-browser (icon theme)
  Kiwix Library       https://localhost:8085/        accessories-dictionary
  WROLPi Files        file:///media/wrolpi/          folder

All HTTPS URLs land on Caddy on localhost; the file:// URL is
dispatched via xdg-open to Thunar.

XFCE Bookworm rejects any .desktop file in $HOME/Desktop without
metadata::trusted set, even for Type=Link entries (verified live).  So
this also restores the trust autostart we previously had for the now-
removed Calamares icon — generalised to walk every *.desktop in
$HOME/Desktop and stamp the trust metadata on each, every session
start.  Idempotent; gio set is a no-op when values already match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

debian-live-config/config/hooks/normal/9999-wrolpi.hook.chroot

@@ -207,6 +207,53 @@ autologin-session=xfce
 EOF
 
 mkdir -p /home/wrolpi/Desktop
+
+# Desktop shortcuts to WROLPi's HTTPS services and the on-drive media
+# directory.  Type=Link entries dispatch via xdg-open, which sidesteps
+# XFCE's executable-launcher trust check (the check only applies to
+# Type=Application entries with an Exec field).  All URLs go through
+# Caddy on localhost, configured in /etc/caddy/Caddyfile.
+cat > /home/wrolpi/Desktop/wrolpi-app.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi
+Type=Link
+URL=https://localhost/
+Icon=/opt/wrolpi/icon.png
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-controller.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Controller
+Type=Link
+URL=https://localhost/controller/
+Icon=/opt/wrolpi/etc/raspberrypios/controller-logo.png
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-help.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Help
+Type=Link
+URL=https://localhost:8086/
+Icon=help-browser
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-kiwix.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=Kiwix Library
+Type=Link
+URL=https://localhost:8085/
+Icon=accessories-dictionary
+EOF
+cat > /home/wrolpi/Desktop/wrolpi-files.desktop <<'EOF'
+[Desktop Entry]
+Encoding=UTF-8
+Name=WROLPi Files
+Type=Link
+URL=file:///media/wrolpi/
+Icon=folder
+EOF
+
 chown -R wrolpi:wrolpi /home/wrolpi/Desktop
 
 # Drop the default Postgres cluster created by the postgresql-* package.

debian-live-config/config/includes.chroot/etc/xdg/autostart/wrolpi-trust-desktop-icons.desktop

@@ -0,0 +1,11 @@
+[Desktop Entry]
+Type=Application
+Name=WROLPi Trust Desktop Icons
+Comment=Mark all desktop launchers as trusted so XFCE will launch them
+Exec=/usr/local/bin/wrolpi-trust-desktop-icons
+TryExec=/usr/local/bin/wrolpi-trust-desktop-icons
+Icon=dialog-information
+Terminal=false
+Categories=System;
+NoDisplay=true
+X-GNOME-Autostart-enabled=true

debian-live-config/config/includes.chroot/usr/local/bin/wrolpi-trust-desktop-icons

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Mark every .desktop file in ~/Desktop as trusted so XFCE will actually
+# launch it on double-click.  XFCE Bookworm requires trust metadata
+# (metadata::trusted + metadata::xfce-exe-checksum) even for Type=Link
+# entries.
+#
+# Runs at user session start via /etc/xdg/autostart/.  Idempotent — safe
+# to re-run; gio set is a no-op if the metadata already matches.
+#
+# Requires gvfs (for the metadata service that `gio set` talks to).
+
+LOG=/tmp/wrolpi-trust-desktop-icons.log
+exec >>"$LOG" 2>&1
+echo "===== $(date) invoked (user=$(id -un)) ====="
+
+DESKTOP="$HOME/Desktop"
+[ -d "$DESKTOP" ] || exit 0
+
+for f in "$DESKTOP"/*.desktop; do
+  [ -f "$f" ] || continue
+  gio set --type=string "$f" metadata::trusted true 2>&1 || true
+  gio set --type=string "$f" metadata::xfce-exe-checksum \
+      "$(sha256sum "$f" | cut -d' ' -f1)" 2>&1 || true
+  touch "$f"
+  echo "trusted: $f"
+done
+
+echo "done"