fix: hex password generation, safe DATABASE_URL, consistent /opt/argus default

Root cause of a real production failure on the first live install
(wap-proxy, 2026-07-25): DB_PASSWORD was generated with
`openssl rand -base64 24`, which can produce '/', '+', or '=' --
docker-compose.yml then naively interpolated the raw password into
postgres://postgres:${DB_PASSWORD}@db:5432/..., and a generated
password containing '/' broke the connection string outright. The API
never became healthy; log ingestion failed completely.

- install.sh now generates with `openssl rand -hex 32` (always
  [0-9a-f], can't produce this class of character). Same fix applied
  everywhere else openssl-rand-base64-24 was referenced.
- docker-compose.yml no longer builds DATABASE_URL by string
  interpolation -- DB_PASSWORD is passed as its own var and the API
  assembles the connection string safely internally using
  net/url.UserPassword (proper percent-encoding), a second,
  independent layer so the installer doesn't rely on the password
  generator alone. See the matching argus-appliance commit for the
  Go-side change and its regression test.
- backup.sh/healthcheck.sh/restore.sh/uninstall.sh still defaulted
  ARGUS_INSTALL_DIR to $HOME/argus, inconsistent with install.sh/
  update.sh's own /opt/argus default (changed in an earlier commit
  this session) -- confirmed live on the same install: healthcheck.sh
  and uninstall.sh reported "no installation found" when run from the
  real, correct directory. All five scripts now agree on /opt/argus.

Corresponding argus-appliance fix (config.go's buildDatabaseURL, v3.73.1)
already built and pushed to git-cloud.weboria.eu/weboria/argus-api.

install.sh

@@ -67,8 +67,16 @@ else
 fi
 
 # ── 4. Generate secrets (first install only — never overwrite an existing .env) ──
+# hex, not base64: base64 can produce '/', '+', '=', any of which breaks the
+# raw postgres://user:PASSWORD@host connection string if it ever ends up
+# interpolated unescaped (confirmed live on the first real production
+# install — see config.go's buildDatabaseURL for the second, independent
+# defensive layer this pairs with). Hex output is always [0-9a-f], which
+# can never produce that class of bug, at 4 bits/char vs base64's ~6 —
+# 32 hex chars (128 bits) is used in place of 24 base64 chars (~144 bits)
+# to keep entropy comparable rather than matching digit-count cosmetically.
 if grep -q '^DB_PASSWORD=change-me-in-production' .env 2>/dev/null; then
-  DB_PASSWORD="$(openssl rand -base64 24 | tr -d '\n')"
+  DB_PASSWORD="$(openssl rand -hex 32)"
   sed -i.bak "s#^DB_PASSWORD=.*#DB_PASSWORD=${DB_PASSWORD}#" .env && rm -f .env.bak
   ok "Generated a secure database password"
 fi