Add terminal TUI and shell completion

docs/COMMAND_REFERENCE.md

@@ -365,6 +365,31 @@ Exit code:
 - `0`: daemon is running and the heartbeat is fresh.
 - `1`: daemon is down or the heartbeat is stale.
 
+### `tui` / `enodia-sentinel-tui`
+
+```bash
+enodia-sentinel tui
+enodia-sentinel-tui
+```
+
+Opens the stdlib curses terminal dashboard for SSH/tmux operators. It does not
+require the optional tray dependencies and reads the same local state as the CLI:
+daemon status, recent alert snapshots, incident index, and event-rule metadata.
+
+Keys:
+
+- `1` / `2` / `3` / `4`: status, alerts, incidents, rules.
+- `j` / `k` or arrows: scroll.
+- `r`: refresh.
+- `/`: filter the current view.
+- `:`: command mode.
+- `Tab`: complete command names in command mode.
+- `Ctrl-L`: redraw.
+- `q`: quit.
+
+Command mode supports `status`, `alerts`, `incidents`, `rules`, `help`,
+`refresh`, `filter <text>`, `clear`, and `quit`.
+
 ### `web`
 
 ```bash
@@ -401,6 +426,25 @@ from `status --json`, and runs `check --json` on demand with the result shown
 as a desktop notification. Requires the `[tray]` extra (`pystray`, `Pillow`);
 the core agent stays dependency-free without it.
 
+### `completion`
+
+```bash
+enodia-sentinel completion bash
+enodia-sentinel completion zsh
+```
+
+Prints a shell completion script for the CLI. Example installs:
+
+```bash
+mkdir -p ~/.local/share/bash-completion/completions
+enodia-sentinel completion bash > ~/.local/share/bash-completion/completions/enodia-sentinel
+
+mkdir -p ~/.zfunc
+enodia-sentinel completion zsh > ~/.zfunc/_enodia-sentinel
+```
+
+For zsh, ensure `~/.zfunc` is in `fpath` before `compinit`.
+
 ### `triage`
 
 ```bash

docs/OPERATIONS.md

@@ -77,6 +77,10 @@ The HTTPS dashboard shows the same posture findings under the Posture tab and
 summarizes FIM/package anchors plus heartbeat freshness under the Integrity tab
 for quick remote review.
 
+For SSH/tmux operators, `enodia-sentinel tui` provides a terminal dashboard over
+the same local state: status, recent alerts, incidents, and rules. Use `:` for
+command mode and `Tab` to complete TUI commands.
+
 On desktop hosts the optional tray applet (`enodia-sentinel-tray`, `[tray]`
 extra) wraps the same workflow: it drives the same `systemctl` units operators
 use directly, so daemon start/stop/restart prompts for polkit authorization as

docs/PACKAGING.md

@@ -114,6 +114,17 @@ empty.
 not installed to a system autostart path by default — desktop users copy it to
 `~/.config/autostart/` themselves.
 
+## Terminal TUI and Completion
+
+The terminal dashboard is stdlib-only and available through
+`enodia-sentinel tui` in source/wrapper installs. Python packaging metadata also
+declares `enodia-sentinel-tui = enodia_sentinel.tui:main` for pip-style script
+generation.
+
+Shell completion has no runtime dependency: operators generate scripts with
+`enodia-sentinel completion bash` or `enodia-sentinel completion zsh` and install
+them in their normal shell completion path.
+
 ## Package Hardening Checklist
 
 - Package version matches `pyproject.toml` and `enodia_sentinel.__version__`.