What's a safe way to SSH from a library browser?

Apache Guacamole is worth a look. You can host it yourself and connect through a browser, and it supports SSH as well as remote desktops. It's more setup than a bare terminal, but you wouldn't need to install a client on the library computer.

Put it behind HTTPS and strong authentication, keep it updated, and check the library's rules before using it. A browser gateway can expose a shell, so treat it as a sensitive service rather than just another webpage.

Check your VPS provider's control panel too. Some providers offer a browser console, which could save you from hosting another service. It may be intended for recovery rather than everyday work, so test whether the speed and keyboard behavior are comfortable for Neovim.

A browser extension could be convenient, but the library may block extensions just like other installations. Also check whether a particular extension still works in the browser version there. An older SSH extension's documentation may describe features that no longer apply.

The shared computer is the awkward part here. Even if your connection is encrypted, you can't be sure what software is running on the machine or whether it records keystrokes. Avoid saving passwords or keys in the browser, sign out when you're done, and consider a separate account on the VPS with limited access. For anything especially sensitive, use a trusted device instead.

Cloudflare Tunnel is another route if you want to reach a machine without exposing it directly, including a computer at home. It's a different setup from a browser terminal though. Check the access and authentication requirements before choosing it, and factor in any domain or service costs.