feat(selfhost): one-command self-host package (epic 6d)

- docker-compose.selfhost.yml pulls the published image (forge.b1fr0st.eu/peter/siftlode) with a
  bundled Postgres — no source build on the operator's host.
- install.sh / install.ps1 generate the four required secrets (.env: POSTGRES_PASSWORD, SECRET_KEY,
  a valid Fernet TOKEN_ENCRYPTION_KEY, OAUTH_REDIRECT_URL), start the stack, and print the first-run
  setup-wizard URL. Everything else is configured in the web wizard.
- docs/self-hosting.md: the copy-paste playbook (get the files, run the installer, finish in the
  wizard, optional Google/SMTP, HTTPS/reverse-proxy, updates + backups).
- Verified end-to-end: a fresh install from the published image boots into setup mode and serves
  the wizard.

install.ps1

@@ -0,0 +1,52 @@
+# Siftlode self-host installer (Windows / PowerShell). Generates secrets into .env, starts the
+# stack from the prebuilt image, and prints the first-run setup-wizard URL. Re-running is safe: an
+# existing .env is left untouched. Requires Docker Desktop (with the compose plugin).
+$ErrorActionPreference = "Stop"
+$Port = if ($env:HTTP_PORT) { $env:HTTP_PORT } else { "8080" }
+
+function New-RandBytes([int]$n) {
+  $b = New-Object byte[] $n
+  $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+  $rng.GetBytes($b)
+  return $b
+}
+
+if (Test-Path .env) {
+  Write-Host ".env already exists — leaving it untouched (delete it to re-generate)."
+} else {
+  $url = Read-Host "Public URL where this instance will be reached [http://localhost:$Port]"
+  if ([string]::IsNullOrWhiteSpace($url)) { $url = "http://localhost:$Port" }
+  $url = $url.TrimEnd('/')
+
+  $secretKey = (New-RandBytes 32 | ForEach-Object { $_.ToString("x2") }) -join ""
+  $fernet = [Convert]::ToBase64String((New-RandBytes 32)).Replace('+', '-').Replace('/', '_')
+  $pgPass = (New-RandBytes 16 | ForEach-Object { $_.ToString("x2") }) -join ""
+
+  @"
+# Generated by install.ps1 — keep secret, never commit. Re-run after deleting to reset.
+POSTGRES_PASSWORD=$pgPass
+SECRET_KEY=$secretKey
+TOKEN_ENCRYPTION_KEY=$fernet
+OAUTH_REDIRECT_URL=$url/auth/callback
+"@ | Set-Content -Path .env -Encoding ascii
+  Write-Host "Wrote .env (secrets generated)."
+}
+
+Write-Host "Pulling and starting Siftlode..."
+docker compose -f docker-compose.selfhost.yml pull
+docker compose -f docker-compose.selfhost.yml up -d
+
+Write-Host "Waiting for the app to come up..."
+foreach ($i in 1..30) {
+  try { Invoke-WebRequest "http://localhost:$Port/healthz" -UseBasicParsing -TimeoutSec 3 | Out-Null; break } catch { Start-Sleep 2 }
+}
+
+Write-Host ""
+Write-Host "==================================================================="
+Write-Host " Siftlode is up. Open the first-run setup wizard at:"
+$logs = docker compose -f docker-compose.selfhost.yml logs api 2>$null
+$match = ($logs | Select-String -Pattern "https?://\S*setup\?token=[A-Za-z0-9_-]+" -AllMatches |
+  ForEach-Object { $_.Matches.Value } | Select-Object -Last 1)
+if ($match) { Write-Host "   $match" }
+else { Write-Host "   (not found yet — run: docker compose -f docker-compose.selfhost.yml logs api | Select-String 'setup?token=')" }
+Write-Host "==================================================================="