Helpdesk gets terminal 1, not the container

A user's analysis container is misbehaving. Helpdesk needs to look. IT does not want helpdesk reading the user's files, opening the user's other terminals, or keeping the access past Friday.

One PATCH adds a password group named support to the container's permissions. Two more grant it terminal: 1 and display: 1. That's the whole grant: one shell instance, one desktop instance, nothing else. The user's terminal 2, the files service, the SQLite UI stay denied. Helpdesk opens the URL, gets the browser's Basic Auth prompt, and is in the same session the user is looking at. Friday afternoon, IT deletes the group.

The old flow was a TeamViewer install, a shared password in a ticket, and full desktop control with no scope.