feat(deploy): установщик, docker-скелет, шаблоны Caddy/LiveKit и CLI

- deploy/install.sh: идемпотентная установка, режимы встроенного и внешнего
  прокси (§10.13), --dry-run/--skip-tls/--reconfigure, auto-детект профиля (§10.10)
- deploy/compose.yaml.tpl: app, livekit, caddy с лимитами, healthcheck,
  ротацией логов, cap_drop и no-new-privileges (§4.3)
- deploy/caddy: Caddyfile.tpl (встроенный) и external-proxy.conf.tpl (наш стенд)
- deploy/livekit: конфиг с TURN, dynacast и лимитами комнат (§10.6)
- deploy/backup.sh + restore.sh: sqlite .backup, tar, age-шифрование (§10.8)
- deploy/update.sh: бэкап → pull/сборка → up → миграции → smoke (§9.3)
- deploy/smoke.sh: проверки §10.9 (healthz/readyz/meta, порты, UFW, fail2ban, бэкап)
- deploy/security-check.sh: аудит SSH, UFW, fail2ban, прав .env и ключей
- deploy/ufw-docker.sh, nftables и fail2ban-конфиги (sshd, glchat-auth, recidive)
- deploy/glchat-cli.sh: команды §10.7, systemd-юнит glchat.service
- scripts/test-install.sh: прогон установщика в чистом Ubuntu 24.04 (systemd-контейнер)
- Dockerfile: multi-stage (node → golang CGO → debian-slim), non-root, healthcheck
- Makefile: lint/test/build/dev/generate/security/smoke и фиксация версий инструментов

Dockerfile

@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1
+
+# ---------- web ----------
+FROM node:24-bookworm-slim AS web
+WORKDIR /src/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY web/ ./
+RUN npm run build
+
+# ---------- go ----------
+FROM golang:1.27-bookworm AS gobuild
+WORKDIR /src
+ARG VERSION=dev
+ARG COMMIT=none
+ARG BUILD_DATE=unknown
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd/ ./cmd/
+COPY internal/ ./internal/
+RUN CGO_ENABLED=1 go build \
+        -tags "sqlite_omit_load_extension" \
+        -trimpath \
+        -ldflags "-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.buildDate=${BUILD_DATE}" \
+        -o /out/glchat ./cmd/glchat
+
+# ---------- runtime ----------
+FROM debian:bookworm-slim AS runtime
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system --gid 10001 glchat \
+    && useradd --system --uid 10001 --gid glchat --home-dir /app --shell /usr/sbin/nologin glchat \
+    && mkdir -p /app/data/db /app/data/files /app/data/backups /app/web \
+    && chown -R glchat:glchat /app
+
+COPY --from=gobuild /out/glchat /usr/local/bin/glchat
+COPY --from=web /src/web/dist /app/web
+
+WORKDIR /app
+USER 10001:10001
+
+ENV DATA_DIR=/app/data \
+    LISTEN_ADDR=0.0.0.0:8080 \
+    LOG_FORMAT=json \
+    LOG_LEVEL=info
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD curl -fsS http://127.0.0.1:8080/healthz || exit 1
+
+ENTRYPOINT ["/usr/local/bin/glchat"]