fix(deploy): надёжный рендер шаблонов и устойчивый цикл подстановки

- render_template: значения передаются через окружение (envsubst), а не
  подставляются в variadic-аргументы — многострочные значения больше не
  ломают разбор, неполный список не уводит bash в бесконечный цикл
- export "$pair": bash сам разбирает KEY=value (было export "${pair}")
- шаблоны переведены на ${VAR}-синтаксис, добавлен compose.test.yaml.tpl
  для тестового режима установщика (--skip-tls без публикации портов)
- dry-run не требует root и работает вне Linux (проверка ОС пропускается)
- install.sh: учитываются --livekit-*-порты и --turn-*-порты в livekit.yaml,
  исправлено экранирование апострофа в итоговой сводке
- scripts/debug-install.sh: трассировка установщика в контейнере

deploy/compose.yaml.tpl

@@ -1,5 +1,5 @@
 # Сгенерировано deploy/install.sh — не редактируйте вручную, изменения перезапишутся.
-# Шаблон: deploy/compose.yaml.tpl. Профиль: {{PROFILE}}
+# Шаблон: deploy/compose.yaml.tpl. Профиль: ${PROFILE}
 name: glchat
 
 x-logging: &default-logging
@@ -9,24 +9,24 @@ x-logging: &default-logging
     max-file: "3"
 
 x-app-env: &app-env
-  DOMAIN: "{{DOMAIN}}"
-  FILES_DOMAIN: "{{FILES_DOMAIN}}"
-  INSTANCE_NAME: "{{INSTANCE_NAME}}"
+  DOMAIN: "${DOMAIN}"
+  FILES_DOMAIN: "${FILES_DOMAIN}"
+  INSTANCE_NAME: "${INSTANCE_NAME}"
   LISTEN_ADDR: "0.0.0.0:8080"
   DATA_DIR: "/app/data"
   WEB_ROOT: "/app/web"
-  LOG_LEVEL: "{{LOG_LEVEL}}"
+  LOG_LEVEL: "${LOG_LEVEL}"
   LOG_FORMAT: "json"
-  SQLITE_READ_POOL: "{{SQLITE_READ_POOL}}"
-  SQLITE_CACHE_SIZE: "{{SQLITE_CACHE_SIZE}}"
-  SQLITE_MMAP_SIZE: "{{SQLITE_MMAP_SIZE}}"
-  GOMAXPROCS: "{{GOMAXPROCS}}"
-  MAX_UPLOAD_SIZE: "{{MAX_UPLOAD_SIZE}}"
+  SQLITE_READ_POOL: "${SQLITE_READ_POOL}"
+  SQLITE_CACHE_SIZE: "${SQLITE_CACHE_SIZE}"
+  SQLITE_MMAP_SIZE: "${SQLITE_MMAP_SIZE}"
+  GOMAXPROCS: "${GOMAXPROCS}"
+  MAX_UPLOAD_SIZE: "${MAX_UPLOAD_SIZE}"
   SHUTDOWN_TIMEOUT_SECONDS: "20"
 
 services:
   app:
-    image: {{APP_IMAGE}}
+    image: ${APP_IMAGE}
     container_name: glchat-app
     restart: unless-stopped
     env_file:
@@ -34,17 +34,17 @@ services:
     environment:
       <<: *app-env
     ports:
-      - "127.0.0.1:{{APP_PORT}}:8080"
+      - "127.0.0.1:${APP_PORT}:8080"
     volumes:
-      - "{{DATA_DIR}}/db:/app/data/db"
-      - "{{DATA_DIR}}/files:/app/data/files"
-      - "{{DATA_DIR}}/backups:/app/data/backups"
+      - "${DATA_DIR}/db:/app/data/db"
+      - "${DATA_DIR}/files:/app/data/files"
+      - "${DATA_DIR}/backups:/app/data/backups"
     logging: *default-logging
     deploy:
       resources:
         limits:
-          cpus: "{{APP_CPUS}}"
-          memory: {{APP_MEMORY_LIMIT}}
+          cpus: "${APP_CPUS}"
+          memory: ${APP_MEMORY_LIMIT}
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/healthz"]
       interval: 30s
@@ -57,21 +57,24 @@ services:
       - ALL
 
   livekit:
-    image: livekit/livekit-server:{{LIVEKIT_IMAGE_TAG}}
+    image: livekit/livekit-server:${LIVEKIT_IMAGE_TAG}
     container_name: glchat-livekit
     restart: unless-stopped
     command: ["--config", "/etc/livekit.yaml"]
     environment:
-      LIVEKIT_KEYS: "{{LIVEKIT_API_KEY}}: {{LIVEKIT_API_SECRET}}"
-    ports:{{LIVEKIT_PORTS}}
+      LIVEKIT_KEYS: "${LIVEKIT_API_KEY}: ${LIVEKIT_API_SECRET}"
+    ports:
+      - "127.0.0.1:${LIVEKIT_WS_PORT}:7880"
+      - "${LIVEKIT_TCP_PORT}:7881"
+      - "${LIVEKIT_UDP_PORT}:7882/udp"
     volumes:
       - ./livekit/livekit.yaml:/etc/livekit.yaml:ro
     logging: *default-logging
     deploy:
       resources:
         limits:
-          cpus: "{{LIVEKIT_CPUS}}"
-          memory: {{LIVEKIT_MEMORY_LIMIT}}
+          cpus: "${LIVEKIT_CPUS}"
+          memory: ${LIVEKIT_MEMORY_LIMIT}
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:7880"]
       interval: 30s
@@ -86,14 +89,14 @@ services:
       - NET_BIND_SERVICE
 
   caddy:
-    image: caddy:{{CADDY_IMAGE_TAG}}
+    image: caddy:${CADDY_IMAGE_TAG}
     container_name: glchat-caddy
     restart: unless-stopped
-    profiles: ["{{CADDY_PROFILE}}"]
+    profiles: ["${CADDY_PROFILE}"]
     ports:
-      - "{{HTTP_PORT}}:80"
-      - "{{HTTPS_PORT}}:443"
-      - "{{HTTPS_PORT}}:443/udp"
+      - "${HTTP_PORT}:80"
+      - "${HTTPS_PORT}:443"
+      - "${HTTPS_PORT}:443/udp"
     volumes:
       - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
       - ./caddy/data:/data
@@ -103,8 +106,8 @@ services:
     deploy:
       resources:
         limits:
-          cpus: "{{CADDY_CPUS}}"
-          memory: {{CADDY_MEMORY_LIMIT}}
+          cpus: "${CADDY_CPUS}"
+          memory: ${CADDY_MEMORY_LIMIT}
     healthcheck:
       test: ["CMD", "caddy", "version"]
       interval: 30s