Implement Phase 8: operational artifacts

- Makefile: build/test/lint/generate/man/install/clean/dist/docker;
  CGO_ENABLED=1 throughout; VERSION from git describe --tags --always
- Dockerfile: multi-stage (golang:1.26-bookworm builder ->
  debian:bookworm-slim runtime); non-root uid 10001 (mcias),
  VOLUME /data, EXPOSE 8443/9443; no toolchain in final image
- dist/mcias.service: hardened systemd unit (ProtectSystem=strict,
  ProtectHome, PrivateTmp, NoNewPrivileges, MemoryDenyWriteExecute,
  CapabilityBoundingSet= empty, EnvironmentFile, LimitNOFILE=65536)
- dist/mcias.env.example: passphrase env file template
- dist/mcias.conf.example: fully-commented production TOML config
- dist/mcias-dev.conf.example: local dev config (/tmp, short expiry)
- dist/mcias.conf.docker.example: container config template
- dist/install.sh: POSIX sh idempotent installer; creates mcias
  user/group, installs binaries, /etc/mcias, /var/lib/mcias,
  systemd unit, man pages; prints post-install instructions
- man/man1/mciassrv.1: mdoc synopsis/config/API/signals/files
- man/man1/mciasctl.1: mdoc all subcommands/env/examples
- man/man1/mciasdb.1: mdoc trust model/safety/all subcommands
- man/man1/mciasgrpcctl.1: mdoc gRPC commands/grpcurl example
- README.md: user-facing quick-start, first-run setup, build
  instructions, CLI references, Docker deployment, security notes
- .gitignore: added /bin/, dist/mcias_*.tar.gz, man/man1/*.gz

dist/mcias.env.example

@@ -0,0 +1,17 @@
+# /etc/mcias/env — Environment file for mciassrv (systemd EnvironmentFile).
+#
+# This file is loaded by the mcias.service unit before the server starts.
+# It must be readable only by root and the mcias service account:
+#
+#   chmod 0640 /etc/mcias/env
+#   chown root:mcias /etc/mcias/env
+#
+# SECURITY: This file contains the master key passphrase. Treat it with
+# the same care as a private key. Do not commit it to version control.
+# Back it up to a secure offline location — losing this passphrase means
+# losing access to all encrypted data in the database.
+
+# Master key passphrase. Used to derive the AES-256 master key via Argon2id.
+# Choose a long, random passphrase (e.g., generated by `openssl rand -base64 32`).
+# This must match the passphrase_env setting in mcias.conf.
+MCIAS_MASTER_PASSPHRASE=change-me-to-a-long-random-passphrase