feat: unified launcher, multi-OS hardening, login alerts & auto-updates

Restructure around a single entry point (automations.sh) with a Gum wizard and
a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the
provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on
Alpine/Debian/Alma; seed root keys from globals/.

- ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec
- daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and
  opt-in Alpine stable-branch upgrades
- generic + per-deployment cloud-init; Gitea release workflow on tag
- README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea

deployments/webfinger/docker-compose.yml

@@ -0,0 +1,38 @@
+# webfinger stack -- one Caddy container that serves /.well-known/webfinger
+# at $BASE_DOMAIN (for OIDC discovery from Tailscale et al.) and redirects
+# everything else to $REDIRECT_URL.
+#
+# Standalone: this binds 80/443 itself, so don't run it on the same host as
+# another stack that also wants those ports unless you put a TCP balancer
+# in front or merge the configs.
+
+name: webfinger
+
+volumes:
+  caddy-data:
+  caddy-config:
+
+services:
+  caddy:
+    image: caddy:${CADDY_TAG:-2-alpine}
+    container_name: caddy-webfinger
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"     # HTTP/3
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    environment:
+      BASE_DOMAIN: "${BASE_DOMAIN}"
+      ISSUER_URL: "${ISSUER_URL}"
+      REDIRECT_URL: "${REDIRECT_URL}"
+      ACME_EMAIL: "${ACME_EMAIL}"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:2019/config/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s