feat: unified launcher, multi-OS hardening, login alerts & auto-updates

Restructure around a single entry point (automations.sh) with a Gum wizard and
a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the
provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on
Alpine/Debian/Alma; seed root keys from globals/.

- ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec
- daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and
  opt-in Alpine stable-branch upgrades
- generic + per-deployment cloud-init; Gitea release workflow on tag
- README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea

globals/globals.env.example

@@ -0,0 +1,26 @@
+# Shared defaults for all deployments and scripts.
+#
+# Copy to globals.env and edit. The launcher (../automations.sh) and the
+# helpers in ../scripts/lib.sh source globals.env if present, otherwise they
+# fall back to the values shown here. The real globals.env is git-ignored.
+
+# ─── Repository ─────────────────────────────────────────────────────────────
+# Where the launcher and cloud-init clone this repo from. Used by the
+# one-liner bootstrap and by every deployment's cloud-init.yml.
+REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
+REPO_BRANCH=main
+
+# ─── Shared deployment defaults ─────────────────────────────────────────────
+# Pre-filled into per-deployment prompts so you only type them once.
+ACME_EMAIL=admin@example.com
+SSH_PORT=22
+
+# ─── SSH authorized keys ────────────────────────────────────────────────────
+# resolve_ssh_keys() prefers this URL when set (fetched live, always current),
+# e.g. a GitHub keys endpoint (https://github.com/<user>.keys) or a raw
+# authorized_keys file. When empty, it falls back to globals/authorized_keys.
+SSH_KEYS_URL=
+
+# ─── Backups ────────────────────────────────────────────────────────────────
+# Age public-key recipient file for encrypted backups (relative to repo root).
+AGE_PUBKEY_FILE=globals/age-pubkey.txt