fix: hex password generation, safe DATABASE_URL, consistent /opt/argus default

Root cause of a real production failure on the first live install
(wap-proxy, 2026-07-25): DB_PASSWORD was generated with
`openssl rand -base64 24`, which can produce '/', '+', or '=' --
docker-compose.yml then naively interpolated the raw password into
postgres://postgres:${DB_PASSWORD}@db:5432/..., and a generated
password containing '/' broke the connection string outright. The API
never became healthy; log ingestion failed completely.

- install.sh now generates with `openssl rand -hex 32` (always
  [0-9a-f], can't produce this class of character). Same fix applied
  everywhere else openssl-rand-base64-24 was referenced.
- docker-compose.yml no longer builds DATABASE_URL by string
  interpolation -- DB_PASSWORD is passed as its own var and the API
  assembles the connection string safely internally using
  net/url.UserPassword (proper percent-encoding), a second,
  independent layer so the installer doesn't rely on the password
  generator alone. See the matching argus-appliance commit for the
  Go-side change and its regression test.
- backup.sh/healthcheck.sh/restore.sh/uninstall.sh still defaulted
  ARGUS_INSTALL_DIR to $HOME/argus, inconsistent with install.sh/
  update.sh's own /opt/argus default (changed in an earlier commit
  this session) -- confirmed live on the same install: healthcheck.sh
  and uninstall.sh reported "no installation found" when run from the
  real, correct directory. All five scripts now agree on /opt/argus.

Corresponding argus-appliance fix (config.go's buildDatabaseURL, v3.73.1)
already built and pushed to git-cloud.weboria.eu/weboria/argus-api.

docker-compose.yml

@@ -108,7 +108,14 @@ services:
     environment:
       TZ: ${TZ:-UTC}
       PORT: "8080"
-      DATABASE_URL: postgres://postgres:${DB_PASSWORD:-postgres}@db:5432/argus?sslmode=disable
+      # DATABASE_URL is not set here — the API builds it internally from
+      # DB_PASSWORD using net/url (proper percent-encoding), instead of this
+      # file naively interpolating the password into a raw connection
+      # string. A raw '${DB_PASSWORD}@...' interpolation breaks outright if
+      # the password ever contains '@', ':', '/', or similar (confirmed
+      # live: an openssl-rand-base64-generated password containing '/'
+      # produced an unparseable URL and the API never became healthy).
+      DB_PASSWORD: ${DB_PASSWORD:-postgres}
       REDIS_URL: redis://valkey:6379/0
       ENVIRONMENT: ${ENVIRONMENT:-production}
       NGINX_CONTAINER: argus-proxy