appview: render the install scripts from config instead of shipping ATCR's

seamark.dev's /install and /settings/devices told users to pipe
seamark.dev/static/install.sh into bash. That file was the unmodified ATCR
script: it announced itself as the "ATCR Credential Helper Installer",
installed docker-credential-atcr, and finished by telling the user to configure
credHelpers for atcr.io, the wrong registry for that deployment. Anyone
following the documented setup ended up pointed at another service. The
templates hardcoded docker-credential-atcr, "atcr" and ~/.atcr/device.json
alongside a correctly themed {{ .RegistryURL }}.

The scripts are now rendered from config by a handler, rather than forked per
brand. A theme overlay was the alternative and was worse: it needed a full copy
of both install.sh and install.ps1 per brand, four scripts to keep in sync, and
the operator asked for these values to come from config.

credential_helper.name is the single knob. Docker resolves a credHelpers value
x by exec'ing docker-credential-x, so the credHelpers value, the binary suffix
and the config directory are genuinely one word, not three that can drift. It
is validated against a strict pattern because it is interpolated into a shell
script.

install.sh renders byte-identical to the deleted static file under the atcr
default, so existing installs are unaffected. install.ps1 differs by one line,
where a stale usage comment named a path the script is not served at.

Two behaviour changes worth noting: these two URLs drop from a one-year
Cache-Control to five minutes, since the body now depends on deployment config;
and credential_helper.tangled_repo becomes a real overridable default. It was
previously assigned over unconditionally and read by nothing, while the shipped
script used a different URL form.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PDqoCE1j3njokkZ9b1C5n9

pkg/appview/installscript/installscript.go

@@ -0,0 +1,115 @@
+// Package installscript renders the credential-helper install scripts
+// (install.sh, install.ps1) from the running deployment's configuration.
+//
+// The scripts used to be static files under pkg/appview/public/static/, which
+// meant every rebranded deployment served atcr.io's script: it installed
+// docker-credential-atcr and told the user to point Docker's credHelpers at
+// atcr.io no matter which registry they had actually been browsing. Rendering
+// them from a Brand keeps the helper binary name, the credHelpers value, the
+// config directory and the registry host in exactly one place, shared with the
+// install/settings UI templates.
+package installscript
+
+import (
+	"embed"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+	"text/template"
+)
+
+//go:embed templates/*.tmpl
+var templatesFS embed.FS
+
+var tmpl = template.Must(template.ParseFS(templatesFS, "templates/*.tmpl"))
+
+// DefaultName is the credential helper brand used when nothing is configured.
+const DefaultName = "atcr"
+
+// DefaultReleasesBaseURL is where the helper release archives are published.
+// The DID-based Tangled URL is used rather than the handle-based one so the
+// link survives a handle rename; pkg/credhelper's self-updater uses the same.
+const DefaultReleasesBaseURL = "https://tangled.org/did:plc:e3kzdezk5gsirzh7eoqplc64"
+
+// nameRE constrains Brand.Name. The value is interpolated into a shell script
+// and a PowerShell script, and Docker additionally requires that it be usable
+// as a filename suffix (docker-credential-<name>), so keep it boring.
+var nameRE = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
+
+// Brand is the credential-helper identity of one deployment. Docker resolves a
+// credHelpers value "x" by executing "docker-credential-x", so the helper's
+// binary name, the credHelpers value and (by convention) the helper's config
+// directory are all the same word. Keeping them as one field is what stops
+// them drifting apart across the scripts and the UI.
+type Brand struct {
+	// Name is the credHelpers value, e.g. "atcr" or "seamark".
+	Name string
+
+	// DisplayName is the human brand shown in script output, e.g. "Seamark".
+	DisplayName string
+
+	// ReleasesBaseURL is the Tangled repo the release archives hang off.
+	ReleasesBaseURL string
+}
+
+// NewBrand normalizes a configured brand, filling in defaults.
+func NewBrand(name, displayName, releasesBaseURL string) (Brand, error) {
+	b := Brand{
+		Name:            strings.TrimSpace(name),
+		DisplayName:     strings.TrimSpace(displayName),
+		ReleasesBaseURL: strings.TrimRight(strings.TrimSpace(releasesBaseURL), "/"),
+	}
+	if b.Name == "" {
+		b.Name = DefaultName
+	}
+	if !nameRE.MatchString(b.Name) {
+		return Brand{}, fmt.Errorf("credential helper name %q must match %s", b.Name, nameRE)
+	}
+	if b.DisplayName == "" {
+		b.DisplayName = strings.ToUpper(b.Name)
+	}
+	if b.ReleasesBaseURL == "" {
+		b.ReleasesBaseURL = DefaultReleasesBaseURL
+	}
+	return b, nil
+}
+
+// BinaryName is the executable Docker looks for: docker-credential-<name>.
+func (b Brand) BinaryName() string { return "docker-credential-" + b.Name }
+
+// ConfigDir is the helper's home-relative config directory, e.g. "~/.atcr".
+func (b Brand) ConfigDir() string { return "~/." + b.Name }
+
+// DeviceFile is where the helper stores its device credential.
+func (b Brand) DeviceFile() string { return b.ConfigDir() + "/device.json" }
+
+// EnvPrefix is the prefix for the install scripts' override variables, e.g.
+// ATCR_VERSION / SEAMARK_VERSION.
+func (b Brand) EnvPrefix() string {
+	return strings.ToUpper(strings.ReplaceAll(b.Name, "-", "_"))
+}
+
+// Params is everything a rendered install script needs.
+type Params struct {
+	Brand
+
+	// RegistryHost is the credHelpers key: the registry host Docker
+	// authenticates against, e.g. "atcr.io" or "seamark.cr". This is NOT
+	// necessarily the site the script was downloaded from.
+	RegistryHost string
+
+	// SiteHost is the web UI host the script is served from, used only for
+	// the usage comment at the top of the script.
+	SiteHost string
+}
+
+// RenderShell writes install.sh for the given params.
+func RenderShell(w io.Writer, p Params) error {
+	return tmpl.ExecuteTemplate(w, "install.sh.tmpl", p)
+}
+
+// RenderPowerShell writes install.ps1 for the given params.
+func RenderPowerShell(w io.Writer, p Params) error {
+	return tmpl.ExecuteTemplate(w, "install.ps1.tmpl", p)
+}