Implement Phase 10: deployment (Dockerfile, systemd, install script)

- Multi-stage Dockerfile: golang:1.25-alpine builder, alpine:3.21 runtime
  CGO_ENABLED=0, stripped binary, non-root user
- systemd: service unit (hardened), backup oneshot, daily timer (02:00 UTC)
- Install script: create user, dirs, config, install units
- Updated PROGRESS.md with all completed phases

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/scripts/install.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+SERVICE_USER=engpad
+SERVICE_DIR=/srv/eng-pad-server
+BIN_DIR=/usr/local/bin
+
+echo "Creating system user..."
+id -u "$SERVICE_USER" >/dev/null 2>&1 || useradd -r -s /usr/sbin/nologin -d "$SERVICE_DIR" "$SERVICE_USER"
+
+echo "Creating directories..."
+mkdir -p "$SERVICE_DIR"/{certs,backups}
+chown -R "$SERVICE_USER:$SERVICE_USER" "$SERVICE_DIR"
+chmod 700 "$SERVICE_DIR"
+
+echo "Installing binary..."
+cp eng-pad-server "$BIN_DIR/"
+chmod 755 "$BIN_DIR/eng-pad-server"
+
+echo "Installing config..."
+if [ ! -f "$SERVICE_DIR/eng-pad-server.toml" ]; then
+    cp deploy/examples/eng-pad-server.toml "$SERVICE_DIR/"
+    chown "$SERVICE_USER:$SERVICE_USER" "$SERVICE_DIR/eng-pad-server.toml"
+    chmod 600 "$SERVICE_DIR/eng-pad-server.toml"
+    echo "  Example config installed. Edit $SERVICE_DIR/eng-pad-server.toml before starting."
+fi
+
+echo "Installing systemd units..."
+cp deploy/systemd/eng-pad-server.service /etc/systemd/system/
+cp deploy/systemd/eng-pad-server-backup.service /etc/systemd/system/
+cp deploy/systemd/eng-pad-server-backup.timer /etc/systemd/system/
+systemctl daemon-reload
+
+echo "Done. Run 'eng-pad-server init -c $SERVICE_DIR/eng-pad-server.toml' to initialize."