Rename grapho to pal, add onboard command, fix interactive input

- Rename grapho → pal across entire codebase (CLI, NixOS module,
  flake, docs, config paths)
- Add `pal onboard` interactive setup wizard with 4 steps:
  device, config repo, sync, backups
- Shows current setup summary when re-running onboard on an
  existing installation with warnings about what will change
- Fix askConfirm/askInput to read from /dev/tty so interactive
  prompts work correctly
- Remove || operator usage in askConfirm (not reliable in Lux)
- Add pal package to nix develop shell
- Document ~/.config/pal/ directory structure in README

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -12,11 +12,11 @@ A NixOS-based system for managing the three types of data across devices:
 
 ```bash
 # One-command setup (public repo, no SSH key needed)
-nix run 'git+https://git.qrty.ink/blu/grapho.git'
+nix run 'git+https://git.qrty.ink/blu/pal.git'
 
 # Or clone first, then run
-git clone https://git.qrty.ink/blu/grapho.git
-cd grapho
+git clone https://git.qrty.ink/blu/pal.git
+cd pal
 nix run .
 ```
 
@@ -26,8 +26,8 @@ nix run .
 
 ```bash
 # 1. Clone the repo
-git clone https://git.qrty.ink/blu/grapho.git
-cd grapho
+git clone https://git.qrty.ink/blu/pal.git
+cd pal
 
 # 2. Run setup (one command - includes all dependencies)
 nix run .
@@ -39,18 +39,18 @@ nix run .
 # 4. (Optional) Set up SSH for push access
 #    Add your SSH key to Gitea: https://git.qrty.ink/user/settings/keys
 #    Then switch to SSH remote:
-git remote set-url origin ssh://git@git.qrty.ink:2222/blu/grapho.git
+git remote set-url origin ssh://git@git.qrty.ink:2222/blu/pal.git
 ```
 
 ### Additional Computers (Joining)
 
 ```bash
 # One command (no SSH key needed for public repo)
-nix run 'git+https://git.qrty.ink/blu/grapho.git'
+nix run 'git+https://git.qrty.ink/blu/pal.git'
 # Choose option [2], enter your config git URL and age key
 
 # Or clone first:
-git clone https://git.qrty.ink/blu/grapho.git && cd grapho
+git clone https://git.qrty.ink/blu/pal.git && cd pal
 nix run . -- <config-git-url> <your-age-key>
 ```
 
@@ -78,10 +78,10 @@ Add to your flake.nix inputs, then import the module:
 
 ```nix
 {
-  inputs.grapho.url = "git+https://git.qrty.ink/blu/grapho.git";
+  inputs.pal.url = "git+https://git.qrty.ink/blu/pal.git";
 
   # In your configuration:
-  imports = [ inputs.grapho.nixosModules.default ];
+  imports = [ inputs.pal.nixosModules.default ];
 }
 ```
 
@@ -306,19 +306,22 @@ No. See [our research](./docs/research/sync-tools-comparison.md). Common issues
 
 But cloud is fine too. This system works with GitHub, Backblaze B2, etc.
 
-## Directory Structure
+## Repository Structure
 
 ```
 .
 ├── flake.nix                 # Entry point
 ├── flake.lock
 ├── README.md
+├── cli/
+│   └── pal.lux               # CLI source (Lux language)
 ├── docs/
 │   ├── research/
 │   │   └── sync-tools-comparison.md
 │   ├── ARCHITECTURE.md
 │   └── LLM-CONTEXT.md        # For AI assistants
 ├── modules/
+│   ├── pal.nix               # Core pal NixOS module
 │   ├── nb.nix
 │   ├── syncthing.nix
 │   ├── neovim.nix
@@ -342,6 +345,47 @@ But cloud is fine too. This system works with GitHub, Backblaze B2, etc.
     └── ustatus
 ```
 
+## Data Directory (`~/.config/pal/`)
+
+When you run `pal onboard` or `pal setup`, this directory is created to hold all your data and configuration. Everything is human-readable unless noted.
+
+```
+~/.config/pal/
+│
+├── pal.toml                    # Main config (TOML) — device name, ports, schedule
+├── age-key.txt                 # Age encryption private key
+├── state.db                    # Event history (SQLite)
+│
+├── config-repo/                # Your system config (git-managed)
+│   └── .git/
+│
+├── sync/                       # Syncthing-managed data (syncs across devices)
+│   ├── notes/                  #   Your notes
+│   ├── documents/              #   Your documents
+│   └── dotfiles/               #   Your dotfiles
+│
+├── syncthing/                  # Syncthing runtime (auto-generated)
+│   ├── config/                 #   config.xml, TLS certs, keys
+│   └── db/                     #   Syncthing index database
+│
+├── restic/                     # Backup settings
+│   ├── password                #   Repository password (auto-generated, plaintext)
+│   ├── repository              #   Repository URL/path (plaintext)
+│   └── cache/                  #   Local cache for faster operations
+│
+├── backups/                    # Restic repository (if backing up locally)
+│   ├── config                  #   ⚠ Encrypted — restic internal, not human-readable
+│   ├── data/                   #   Encrypted, deduplicated backup chunks
+│   ├── index/                  #   Backup index
+│   ├── keys/                   #   Repository encryption keys
+│   ├── locks/                  #   Lock files
+│   └── snapshots/              #   Snapshot metadata
+│
+└── server/                     # Mount point for remote server storage
+```
+
+**What's human-readable?** `pal.toml`, `restic/password`, `restic/repository`, and everything in `sync/` and `config-repo/`. The `syncthing/config/` directory is auto-generated XML. The `backups/` directory is a restic repository where everything is encrypted by design — use `pal backup list` to inspect snapshots.
+
 ## Contributing
 
 PRs welcome! Please read [ARCHITECTURE.md](./docs/ARCHITECTURE.md) first.