feat: unified launcher, multi-OS hardening, login alerts & auto-updates

Restructure around a single entry point (automations.sh) with a Gum wizard and
a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the
provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on
Alpine/Debian/Alma; seed root keys from globals/.

- ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec
- daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and
  opt-in Alpine stable-branch upgrades
- generic + per-deployment cloud-init; Gitea release workflow on tag
- README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea

deployments/headscale/Caddyfile

@@ -0,0 +1,36 @@
+# Caddyfile for headscale stack.
+#
+# Auto-issues a Let's Encrypt cert for $HEADSCALE_DOMAIN and reverse-proxies
+# to headscale's HTTP listener on :8080. Tailscale clients require this
+# exact hostname over HTTPS.
+
+{
+    email {$ACME_EMAIL}
+}
+
+{$HEADSCALE_DOMAIN} {
+    encode zstd gzip
+
+    reverse_proxy headscale:8080 {
+        header_up X-Real-IP {http.request.remote.host}
+        # Long-lived noise/wireguard control streams; lift the default
+        # idle limit so they don't get torn down.
+        flush_interval -1
+        transport http {
+            read_timeout  10m
+            write_timeout 10m
+        }
+    }
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains"
+        X-Content-Type-Options    "nosniff"
+        Referrer-Policy           "strict-origin-when-cross-origin"
+        -Server
+    }
+
+    log {
+        output stdout
+        format console
+    }
+}