feat(deploy): установщик, docker-скелет, шаблоны Caddy/LiveKit и CLI

- deploy/install.sh: идемпотентная установка, режимы встроенного и внешнего
  прокси (§10.13), --dry-run/--skip-tls/--reconfigure, auto-детект профиля (§10.10)
- deploy/compose.yaml.tpl: app, livekit, caddy с лимитами, healthcheck,
  ротацией логов, cap_drop и no-new-privileges (§4.3)
- deploy/caddy: Caddyfile.tpl (встроенный) и external-proxy.conf.tpl (наш стенд)
- deploy/livekit: конфиг с TURN, dynacast и лимитами комнат (§10.6)
- deploy/backup.sh + restore.sh: sqlite .backup, tar, age-шифрование (§10.8)
- deploy/update.sh: бэкап → pull/сборка → up → миграции → smoke (§9.3)
- deploy/smoke.sh: проверки §10.9 (healthz/readyz/meta, порты, UFW, fail2ban, бэкап)
- deploy/security-check.sh: аудит SSH, UFW, fail2ban, прав .env и ключей
- deploy/ufw-docker.sh, nftables и fail2ban-конфиги (sshd, glchat-auth, recidive)
- deploy/glchat-cli.sh: команды §10.7, systemd-юнит glchat.service
- scripts/test-install.sh: прогон установщика в чистом Ubuntu 24.04 (systemd-контейнер)
- Dockerfile: multi-stage (node → golang CGO → debian-slim), non-root, healthcheck
- Makefile: lint/test/build/dev/generate/security/smoke и фиксация версий инструментов

deploy/compose.yaml.tpl

@@ -0,0 +1,115 @@
+# Сгенерировано deploy/install.sh — не редактируйте вручную, изменения перезапишутся.
+# Шаблон: deploy/compose.yaml.tpl. Профиль: {{PROFILE}}
+name: glchat
+
+x-logging: &default-logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "3"
+
+x-app-env: &app-env
+  DOMAIN: "{{DOMAIN}}"
+  FILES_DOMAIN: "{{FILES_DOMAIN}}"
+  INSTANCE_NAME: "{{INSTANCE_NAME}}"
+  LISTEN_ADDR: "0.0.0.0:8080"
+  DATA_DIR: "/app/data"
+  WEB_ROOT: "/app/web"
+  LOG_LEVEL: "{{LOG_LEVEL}}"
+  LOG_FORMAT: "json"
+  SQLITE_READ_POOL: "{{SQLITE_READ_POOL}}"
+  SQLITE_CACHE_SIZE: "{{SQLITE_CACHE_SIZE}}"
+  SQLITE_MMAP_SIZE: "{{SQLITE_MMAP_SIZE}}"
+  GOMAXPROCS: "{{GOMAXPROCS}}"
+  MAX_UPLOAD_SIZE: "{{MAX_UPLOAD_SIZE}}"
+  SHUTDOWN_TIMEOUT_SECONDS: "20"
+
+services:
+  app:
+    image: {{APP_IMAGE}}
+    container_name: glchat-app
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      <<: *app-env
+    ports:
+      - "127.0.0.1:{{APP_PORT}}:8080"
+    volumes:
+      - "{{DATA_DIR}}/db:/app/data/db"
+      - "{{DATA_DIR}}/files:/app/data/files"
+      - "{{DATA_DIR}}/backups:/app/data/backups"
+    logging: *default-logging
+    deploy:
+      resources:
+        limits:
+          cpus: "{{APP_CPUS}}"
+          memory: {{APP_MEMORY_LIMIT}}
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/healthz"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  livekit:
+    image: livekit/livekit-server:{{LIVEKIT_IMAGE_TAG}}
+    container_name: glchat-livekit
+    restart: unless-stopped
+    command: ["--config", "/etc/livekit.yaml"]
+    environment:
+      LIVEKIT_KEYS: "{{LIVEKIT_API_KEY}}: {{LIVEKIT_API_SECRET}}"
+    ports:{{LIVEKIT_PORTS}}
+    volumes:
+      - ./livekit/livekit.yaml:/etc/livekit.yaml:ro
+    logging: *default-logging
+    deploy:
+      resources:
+        limits:
+          cpus: "{{LIVEKIT_CPUS}}"
+          memory: {{LIVEKIT_MEMORY_LIMIT}}
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:7880"]
+      interval: 30s
+      timeout: 5s
+      start_period: 15s
+      retries: 3
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_BIND_SERVICE
+
+  caddy:
+    image: caddy:{{CADDY_IMAGE_TAG}}
+    container_name: glchat-caddy
+    restart: unless-stopped
+    profiles: ["{{CADDY_PROFILE}}"]
+    ports:
+      - "{{HTTP_PORT}}:80"
+      - "{{HTTPS_PORT}}:443"
+      - "{{HTTPS_PORT}}:443/udp"
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./caddy/data:/data
+      - ./caddy/config:/config
+      - ./caddy/logs:/var/log/caddy
+    logging: *default-logging
+    deploy:
+      resources:
+        limits:
+          cpus: "{{CADDY_CPUS}}"
+          memory: {{CADDY_MEMORY_LIMIT}}
+    healthcheck:
+      test: ["CMD", "caddy", "version"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+    security_opt:
+      - no-new-privileges:true