feat: switch to Weboria's own registry, clean licensing docs, expand product copy

Registry: docker-compose.yml now pulls argus-api/argus-ui/argus-proxy from
git-cloud.weboria.eu/weboria (Gitea's built-in container registry) instead
of ghcr.io. Built and pushed real production images from main (v3.73.0)
before switching — verified anonymous `docker pull` works for all three
with zero login required, matching the public installer's no-friction
promise. install.sh's registry comment updated to match; no more "gap."

Licensing: reworked per a full commercial-distribution review. Removed
MaxMind/GeoLite2 entirely (confirmed geoip2-golang isn't even in go.mod —
GeoIP is RIR-based, not MaxMind-based, and has been for a while).
Clarified TimescaleDB's licensing story (embedded component distributed
as part of the appliance, not a hosted DB service) rather than leaving it
under a vague "reviewed before bundling" note. Added missing real
dependencies grounded against the actual Dockerfiles (Alpine Linux,
PostgreSQL, Go runtime, Node.js build-time-only, OpenSSL, curl, BusyBox).
Renamed THIRD_PARTY_LICENSES -> THIRD_PARTY_LICENSES.md, added a
"Weboria Proprietary Components" section. Removed the "pending legal
review" section that was specifically about MaxMind/TimescaleDB, now
resolved by the above -- LICENSE's own placeholder-pending-final-terms
disclaimer stays, since drafting real commercial license text is separate
legal work, not something to paper over.

README: removed the internal "this repo contains no proprietary code"
meta-description (customers don't need to see project scaffolding notes)
and the "known gap" callout (both gaps closed above). Expanded the
feature list with a dedicated ANIS Threat Intelligence section and richer
detail on DNS Security, Bot/AI-crawler defense, and the Guided Security
Policy Center. Stronger positioning copy up top.

install.sh

@@ -11,12 +11,10 @@ set -euo pipefail
 REPO_RAW_BASE="https://git-cloud.weboria.eu/weboria/argus-installer/raw/branch/main"
 INSTALL_DIR="${ARGUS_INSTALL_DIR:-/opt/argus}"
 NETWORK_NAME="argus-network"
-# The image registry is still ghcr.io (GitHub Container Registry) today —
-# Weboria's own private registry (registry.weboria.eu) is provisioned but
-# not yet serving images. docker-compose.yml's image: lines point at ghcr.io
-# directly rather than a variable here, since that's the only registry that
-# actually has published images right now; switching to registry.weboria.eu
-# is a one-line change to those image: lines once it's live, not a rewrite.
+# Production images are pulled from Weboria's own registry, built into
+# git-cloud.weboria.eu (Gitea's container registry) — docker-compose.yml's
+# image: lines reference git-cloud.weboria.eu/weboria/argus-{api,ui,proxy}
+# directly. Anonymous docker pull works with no login required.
 
 # ── Output helpers ────────────────────────────────────────────────────────────
 bold()  { printf '\033[1m%s\033[0m\n' "$1"; }