feat(paseo): select the terminal shell through SHELL

Paseo spawns terminals with process.env.SHELL and falls back to /bin/sh,
which is dash. It never consults the login shell, so chsh has no effect --
and would be reverted by the next rebuild regardless.

paseo/.env.example

@@ -23,3 +23,8 @@ PASEO_LABEL=paseo
 
 # Timezone for logs and agent shells.
 TZ=Asia/Ho_Chi_Minh
+
+# Shell for Paseo's terminals. Paseo reads $SHELL and falls back to /bin/sh
+# (dash), ignoring the user's login shell, so set it here rather than running
+# chsh -- which would be reverted by the next rebuild anyway.
+SHELL=/bin/zsh

paseo/README.md

@@ -36,6 +36,7 @@ the old entry is cached in `localStorage`.
 | `PASEO_TRUSTED_PROXIES` | Set to `uniquelocal`, or the UI loads but never connects. |
 | `PASEO_LABEL` | Container hostname. Paseo shows it as the host label in the UI; without it you get a random container ID. |
 | `TZ` | Timezone for logs and agent shells. |
+| `SHELL` | Shell for Paseo's terminals. Paseo reads `$SHELL` and falls back to `/bin/sh`, ignoring the login shell, so `chsh` has no effect. |
 
 `PASEO_TRUSTED_PROXIES` matches the *source IP* of the proxy, so hostnames are
 rejected. By default the daemon believes `X-Forwarded-Proto` only from
@@ -59,7 +60,8 @@ Listens on `6767`, published nowhere — the platform maps the domain to it, so
 | `paseo-workspace` | `/workspace` | Code the agents work on |
 
 Claude Code and `gh` keep their config in `/home/paseo`, so both logins survive
-a redeploy.
+a redeploy. Dotfiles live there too — a `.zshrc` or oh-my-zsh install persists,
+but anything written outside `$HOME` (`chsh`, `apt install`) is lost on rebuild.
 
 ## Image
 

paseo/compose.yml

@@ -4,6 +4,7 @@ services:
     hostname: ${PASEO_LABEL}
     environment:
       - TZ=${TZ}
+      - SHELL=${SHELL}
       - PASEO_PASSWORD=${PASEO_PASSWORD}
       - PASEO_HOSTNAMES=${PASEO_HOSTNAMES}
       - PASEO_TRUSTED_PROXIES=${PASEO_TRUSTED_PROXIES}