feat: unified launcher, multi-OS hardening, login alerts & auto-updates

Restructure around a single entry point (automations.sh) with a Gum wizard and
a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the
provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on
Alpine/Debian/Alma; seed root keys from globals/.

- ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec
- daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and
  opt-in Alpine stable-branch upgrades
- generic + per-deployment cloud-init; Gitea release workflow on tag
- README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea

deployments/headscale/.env.example

@@ -0,0 +1,30 @@
+# Copy to .env and fill in. docker compose picks .env up automatically.
+
+# ─── Public hostnames ───────────────────────────────────────────────────────
+# Bare hostname (no scheme) where headscale will be reached. Tailscale
+# clients connect here over HTTPS.
+HEADSCALE_DOMAIN=hs.example.com
+
+# Email for Let's Encrypt registration / expiry notifications.
+ACME_EMAIL=admin@example.com
+
+# Magic-DNS suffix for nodes inside the tailnet. Example: with
+# TAILNET_DOMAIN=tail.example.com, a host called "laptop" will resolve to
+# laptop.tail.example.com. MUST be different from HEADSCALE_DOMAIN.
+TAILNET_DOMAIN=tail.example.com
+
+# ─── OIDC (pocket-id) ───────────────────────────────────────────────────────
+# Hostname (no scheme) of your pocket-id deployment, used as the OIDC
+# issuer. Must match the issuer URL pocket-id advertises at
+# /.well-known/openid-configuration.
+POCKETID_DOMAIN=auth.example.com
+
+# Register a new OIDC client in pocket-id's admin UI with redirect URI:
+#   https://${HEADSCALE_DOMAIN}/oidc/callback
+# Then paste the credentials here.
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+
+# ─── Image tags ─────────────────────────────────────────────────────────────
+HEADSCALE_TAG=0.28.0
+CADDY_TAG=2-alpine