Implement Phase 10: deployment (Dockerfile, systemd, install script)

- Multi-stage Dockerfile: golang:1.25-alpine builder, alpine:3.21 runtime
  CGO_ENABLED=0, stripped binary, non-root user
- systemd: service unit (hardened), backup oneshot, daily timer (02:00 UTC)
- Install script: create user, dirs, config, install units
- Updated PROGRESS.md with all completed phases

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/scripts/install.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+SERVICE_USER=engpad
+SERVICE_DIR=/srv/eng-pad-server
+BIN_DIR=/usr/local/bin
+
+echo "Creating system user..."
+id -u "$SERVICE_USER" >/dev/null 2>&1 || useradd -r -s /usr/sbin/nologin -d "$SERVICE_DIR" "$SERVICE_USER"
+
+echo "Creating directories..."
+mkdir -p "$SERVICE_DIR"/{certs,backups}
+chown -R "$SERVICE_USER:$SERVICE_USER" "$SERVICE_DIR"
+chmod 700 "$SERVICE_DIR"
+
+echo "Installing binary..."
+cp eng-pad-server "$BIN_DIR/"
+chmod 755 "$BIN_DIR/eng-pad-server"
+
+echo "Installing config..."
+if [ ! -f "$SERVICE_DIR/eng-pad-server.toml" ]; then
+    cp deploy/examples/eng-pad-server.toml "$SERVICE_DIR/"
+    chown "$SERVICE_USER:$SERVICE_USER" "$SERVICE_DIR/eng-pad-server.toml"
+    chmod 600 "$SERVICE_DIR/eng-pad-server.toml"
+    echo "  Example config installed. Edit $SERVICE_DIR/eng-pad-server.toml before starting."
+fi
+
+echo "Installing systemd units..."
+cp deploy/systemd/eng-pad-server.service /etc/systemd/system/
+cp deploy/systemd/eng-pad-server-backup.service /etc/systemd/system/
+cp deploy/systemd/eng-pad-server-backup.timer /etc/systemd/system/
+systemctl daemon-reload
+
+echo "Done. Run 'eng-pad-server init -c $SERVICE_DIR/eng-pad-server.toml' to initialize."

deploy/systemd/eng-pad-server-backup.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Engineering Pad Server Backup
+
+[Service]
+Type=oneshot
+User=engpad
+Group=engpad
+ExecStart=/usr/local/bin/eng-pad-server snapshot -c /srv/eng-pad-server/eng-pad-server.toml

deploy/systemd/eng-pad-server-backup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Daily Engineering Pad Server Backup
+
+[Timer]
+OnCalendar=*-*-* 02:00:00
+RandomizedDelaySec=300
+
+[Install]
+WantedBy=timers.target

deploy/systemd/eng-pad-server.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=Engineering Pad Server
+After=network.target
+
+[Service]
+Type=simple
+User=engpad
+Group=engpad
+ExecStart=/usr/local/bin/eng-pad-server server -c /srv/eng-pad-server/eng-pad-server.toml
+Restart=on-failure
+RestartSec=5
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ReadWritePaths=/srv/eng-pad-server
+
+[Install]
+WantedBy=multi-user.target