fix: hex password generation, safe DATABASE_URL, consistent /opt/argus default

Root cause of a real production failure on the first live install
(wap-proxy, 2026-07-25): DB_PASSWORD was generated with
`openssl rand -base64 24`, which can produce '/', '+', or '=' --
docker-compose.yml then naively interpolated the raw password into
postgres://postgres:${DB_PASSWORD}@db:5432/..., and a generated
password containing '/' broke the connection string outright. The API
never became healthy; log ingestion failed completely.

- install.sh now generates with `openssl rand -hex 32` (always
  [0-9a-f], can't produce this class of character). Same fix applied
  everywhere else openssl-rand-base64-24 was referenced.
- docker-compose.yml no longer builds DATABASE_URL by string
  interpolation -- DB_PASSWORD is passed as its own var and the API
  assembles the connection string safely internally using
  net/url.UserPassword (proper percent-encoding), a second,
  independent layer so the installer doesn't rely on the password
  generator alone. See the matching argus-appliance commit for the
  Go-side change and its regression test.
- backup.sh/healthcheck.sh/restore.sh/uninstall.sh still defaulted
  ARGUS_INSTALL_DIR to $HOME/argus, inconsistent with install.sh/
  update.sh's own /opt/argus default (changed in an earlier commit
  this session) -- confirmed live on the same install: healthcheck.sh
  and uninstall.sh reported "no installation found" when run from the
  real, correct directory. All five scripts now agree on /opt/argus.

Corresponding argus-appliance fix (config.go's buildDatabaseURL, v3.73.1)
already built and pushed to git-cloud.weboria.eu/weboria/argus-api.

restore.sh

@@ -5,11 +5,11 @@
 # that already has data on it, uninstall.sh --remove-data && install.sh
 # first, then run this.
 #
-#   cd ~/argus && ./restore.sh argus-backup-20260719-120000.tar.gz
+#   cd /opt/argus && ./restore.sh argus-backup-20260719-120000.tar.gz
 #
 set -euo pipefail
 
-INSTALL_DIR="${ARGUS_INSTALL_DIR:-$HOME/argus}"
+INSTALL_DIR="${ARGUS_INSTALL_DIR:-/opt/argus}"
 ARCHIVE="${1:-}"
 
 bold()  { printf '\033[1m%s\033[0m\n' "$1"; }