start: private new-tab dashboard at /start (tasks, notifications, backups/timers, server + containers, service status, trackers, editable links, / search)

- home schema: home.links (seeded, owner-editable) and home.snapshots (written by a host collector)
- deploy/home-collector: stdlib Python + systemd user timer (60s) that snapshots /proc stats,
  docker containers, systemd timers, service HTTP checks and ntfy topics via a limited role
- extras/newtab-extension: MV3 new-tab override, zipped to static/newtab-extension.zip
- owner-only pages skip Google Analytics; /trackers/health#body anchor for weigh-ins

src/lib/server/db/schema/home.ts

@@ -0,0 +1,37 @@
+import { sql } from 'drizzle-orm';
+import { check, index, integer, jsonb, text } from 'drizzle-orm/pg-core';
+import { homeSchema } from './schemas';
+import { id, timestamps, timestamptz } from './helpers';
+
+// The owner's start page (/start, also his browser new-tab page). Owner only, no user_id:
+// like tasks and health the schema is granted to personal_app only (no personal_ro).
+
+/** Personal quick links on /start: editable, reorderable, grouped by `section`. */
+export const homeLinks = homeSchema.table(
+	'links',
+	{
+		id: id(),
+		title: text('title').notNull(),
+		url: text('url').notNull(),
+		section: text('section').notNull().default('links'),
+		sortOrder: integer('sort_order').notNull().default(0),
+		...timestamps
+	},
+	(t) => [
+		index('links_sort_idx').on(t.section, t.sortOrder),
+		check('links_title_check', sql`length(btrim(${t.title})) between 1 and 80`),
+		check('links_url_check', sql`${t.url} ~ '^https?://' and length(${t.url}) <= 2000`)
+	]
+);
+
+/**
+ * Snapshots written by the host-side collector (deploy/home-collector, a systemd user timer
+ * on the server): `host` = CPU/RAM/disk/containers/timers/service checks, `ntfy` = recent
+ * notifications. One row per key, overwritten each run; the collector role (home_collector)
+ * may only upsert here.
+ */
+export const homeSnapshots = homeSchema.table('snapshots', {
+	key: text('key').primaryKey(),
+	data: jsonb('data').notNull(),
+	collectedAt: timestamptz('collected_at').notNull().defaultNow()
+});

src/lib/server/db/schema/index.ts

@@ -16,3 +16,4 @@ export * from './health';
 export * from './books';
 export * from './tasks';
 export * from './groceries';
+export * from './home';

src/lib/server/db/schema/schemas.ts

@@ -16,3 +16,4 @@ export const healthSchema = pgSchema('health');
 export const booksSchema = pgSchema('books');
 export const tasksSchema = pgSchema('tasks');
 export const groceriesSchema = pgSchema('groceries');
+export const homeSchema = pgSchema('home');

src/lib/server/owner.ts

@@ -20,6 +20,7 @@ export function requireOwner(event: OwnerEvent) {
 
 /** Paths that only the owner may see (checked in hooks.server.ts before any route runs). */
 export const ownerOnlyPrefixes = [
+	'/start',
 	'/trackers/health',
 	'/trackers/tasks',
 	'/trackers/groceries',
@@ -39,6 +40,7 @@ export const ownerOnlyPatterns = [/^\/trackers\/books\/\d+\/(read|progress|notes
  * (404) in hooks.server.ts, which also covers form actions on the public book pages.
  */
 export const ownerWritePrefixes = [
+	'/start',
 	'/trackers/health',
 	'/trackers/tasks',
 	'/trackers/groceries',