feat(distribution): production install/update/backup scripts + public-repo sync (#106)

Builds the customer-facing distribution: a curated distribution/ directory
containing only what an end customer needs (production docker-compose.yml
with no build: sections, install.sh/update.sh/uninstall.sh/healthcheck.sh/
backup.sh/restore.sh, a customer-facing CHANGELOG.md, and README/LICENSE/
NOTICE/THIRD_PARTY_LICENSES) — pushed as the initial content of the new
public alleyviper/argus repo.

install.sh: detects OS, validates Docker/Compose, fetches all deployment
files, generates a secure DB password, creates the required Docker
network, pulls images, starts the stack, waits for health, and rotates
the default admin/admin credentials via the auth API — printing the
generated password once at the end.

update.sh/healthcheck.sh/backup.sh/restore.sh/uninstall.sh formalize what
was previously ad-hoc README snippets into real, safe-by-default scripts
(uninstall.sh keeps data unless --remove-data is explicitly passed and
confirmed; restore.sh requires typed confirmation and documents that it
targets a fresh install, not a live merge).

Added a sync-distribution job to release.yml: after a successful release,
mirrors distribution/ into the public repo and creates a matching
(customer-facing, commit-log-free) release marker there. Needs a one-time
setup step — a fine-grained PAT scoped to alleyviper/argus added as the
ARGUS_PUBLIC_REPO_TOKEN secret — the job cleanly no-ops until that's added.

Not yet done: GHCR package visibility (argus-secure-api/-ui/-nginx) is
still private, which blocks a genuine end-to-end curl-install test from a
clean, unauthenticated environment — deferred at the user's request until
they flip it manually (GitHub does not expose this via API).

update.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+#
+# ARGUS updater — pulls the latest published images and restarts the stack.
+#
+#   cd ~/argus && ./update.sh
+#   (or, if you don't have it locally yet)
+#   curl -fsSL https://raw.githubusercontent.com/alleyviper/argus/main/update.sh | bash
+#
+set -euo pipefail
+
+INSTALL_DIR="${ARGUS_INSTALL_DIR:-$HOME/argus}"
+
+bold()  { printf '\033[1m%s\033[0m\n' "$1"; }
+info()  { printf '  %s\n' "$1"; }
+ok()    { printf '  \033[32m✓\033[0m %s\n' "$1"; }
+fail()  { printf '  \033[31m✗\033[0m %s\n' "$1" >&2; exit 1; }
+
+bold "ARGUS Updater"
+echo
+
+[ -f "$INSTALL_DIR/docker-compose.yml" ] || fail "No ARGUS installation found at $INSTALL_DIR (set ARGUS_INSTALL_DIR if you installed elsewhere)."
+cd "$INSTALL_DIR"
+
+API_HOST_PORT="$(grep -oP '^API_HOST_PORT=\K.*' .env 2>/dev/null || true)"
+API_HOST_PORT="${API_HOST_PORT:-9080}"
+
+BEFORE_VERSION="$(curl -fsS "http://127.0.0.1:${API_HOST_PORT}/health" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || echo "unknown")"
+info "Current version: ${BEFORE_VERSION}"
+
+bold "Pulling latest images..."
+docker compose pull
+
+bold "Restarting..."
+docker compose up -d
+echo
+
+bold "Waiting for ARGUS to become healthy..."
+READY=false
+for _ in $(seq 1 60); do
+  if curl -fsS "http://127.0.0.1:${API_HOST_PORT}/health" >/dev/null 2>&1; then
+    READY=true
+    break
+  fi
+  sleep 5
+done
+
+if [ "$READY" != "true" ]; then
+  fail "ARGUS did not come back healthy within 5 minutes. Check: docker compose -f $INSTALL_DIR/docker-compose.yml logs"
+fi
+
+AFTER_VERSION="$(curl -fsS "http://127.0.0.1:${API_HOST_PORT}/health" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || echo "unknown")"
+ok "ARGUS is healthy — now running version ${AFTER_VERSION}"
+if [ "$BEFORE_VERSION" != "$AFTER_VERSION" ]; then
+  info "Updated: ${BEFORE_VERSION} → ${AFTER_VERSION}"
+else
+  info "Already up to date."
+fi