feat: switch to Weboria's own registry, clean licensing docs, expand product copy

Registry: docker-compose.yml now pulls argus-api/argus-ui/argus-proxy from
git-cloud.weboria.eu/weboria (Gitea's built-in container registry) instead
of ghcr.io. Built and pushed real production images from main (v3.73.0)
before switching — verified anonymous `docker pull` works for all three
with zero login required, matching the public installer's no-friction
promise. install.sh's registry comment updated to match; no more "gap."

Licensing: reworked per a full commercial-distribution review. Removed
MaxMind/GeoLite2 entirely (confirmed geoip2-golang isn't even in go.mod —
GeoIP is RIR-based, not MaxMind-based, and has been for a while).
Clarified TimescaleDB's licensing story (embedded component distributed
as part of the appliance, not a hosted DB service) rather than leaving it
under a vague "reviewed before bundling" note. Added missing real
dependencies grounded against the actual Dockerfiles (Alpine Linux,
PostgreSQL, Go runtime, Node.js build-time-only, OpenSSL, curl, BusyBox).
Renamed THIRD_PARTY_LICENSES -> THIRD_PARTY_LICENSES.md, added a
"Weboria Proprietary Components" section. Removed the "pending legal
review" section that was specifically about MaxMind/TimescaleDB, now
resolved by the above -- LICENSE's own placeholder-pending-final-terms
disclaimer stays, since drafting real commercial license text is separate
legal work, not something to paper over.

README: removed the internal "this repo contains no proprietary code"
meta-description (customers don't need to see project scaffolding notes)
and the "known gap" callout (both gaps closed above). Expanded the
feature list with a dedicated ANIS Threat Intelligence section and richer
detail on DNS Security, Bot/AI-crawler defense, and the Guided Security
Policy Center. Stronger positioning copy up top.

docker-compose.yml

@@ -80,7 +80,7 @@ services:
 
   # Go API Server
   api:
-    image: ghcr.io/alleyviper/argus-secure-api:latest
+    image: git-cloud.weboria.eu/weboria/argus-api:latest
     container_name: argus-api
     restart: unless-stopped
     # Container hardening: no-new-privileges blocks setuid privilege
@@ -154,7 +154,7 @@ services:
 
   # React UI (Admin Panel), served over HTTPS
   ui:
-    image: ghcr.io/alleyviper/argus-secure-ui:latest
+    image: git-cloud.weboria.eu/weboria/argus-ui:latest
     container_name: argus-ui
     restart: unless-stopped
     security_opt:
@@ -180,7 +180,7 @@ services:
   # Nginx reverse proxy — host network mode, so real client IPs are visible
   # directly without needing PROXY protocol.
   nginx:
-    image: ghcr.io/alleyviper/argus-secure-nginx:latest
+    image: git-cloud.weboria.eu/weboria/argus-proxy:latest
     container_name: argus-proxy
     restart: always
     network_mode: host