chore: initial project skeleton

Acauã: Network Detection & Threat Hunting, heuristic analysis over a
rolling 7-day window using deterministic math (time series, graph
theory, information theory) instead of opaque ML models. Third
product in the Ciberfauna ecosystem, alongside Guará and Sabiá.

Follows the ecosystem's established conventions: OpenWolf project
memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the
same self-hosted runners, Conventional Commits, SemVer, logo and
productName handling, MIT OR Apache-2.0 licensing.

Architecture decision (made with the project owner after a dedicated
consultation, not the original blueprint's suggested stack): Rust
throughout, not Python/FastAPI/React. Most of the statistics (Bowley
skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection,
pivot chains) reduces to SQL over an embedded DuckDB/Parquet store;
only the spectral analysis and graph centrality need host-language
code, and both have workable Rust crates. Documented in full, including
six corrections to the original blueprint's math (Rayleigh/Schuster
instead of a degenerate Lomb-Scargle over bare timestamps, an explicit
sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of
unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+
licensing caution, deterministic per-alert evidence), in
docs/architecture.md.

Skeleton only: crates/acaua-core has the four detection pillars,
fusion, storage, zeek log parsing and the updater as typed stubs that
compile and return a clear "skeleton" status rather than real
detection logic — that is separate, future work. crates/acaua-cli has
serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also
already includes the one-click desktop self-update mechanism shared
with Guará and Sabiá (AppImage/.deb/Windows installer), even with no
release published yet, for consistency across the ecosystem.

No Gitea repository exists for this project yet; this is a local-only
commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

docs/cli.md

@@ -0,0 +1,107 @@
+# Terminal
+
+**English** · [Português](pt-BR/cli.md)
+
+The `acaua` binary is both the CLI and the daemon. This page describes the
+commands that exist in the `0.1.0` skeleton. Detection is not implemented yet;
+`analyze` validates input and returns a stub report.
+
+```text
+acaua <command> [options]
+
+Commands:
+  serve    Start the API and embedded UI
+  analyze  Analyze a Zeek log directory
+  doctor   Check the local environment
+  update   Check or apply a CLI update
+```
+
+## `acaua serve`
+
+Starts the HTTP API and the embedded UI.
+
+```bash
+acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
+```
+
+| Option | Default | Meaning |
+|---|---|---|
+| `--bind` | `127.0.0.1:8787` | Listen address |
+| `--data-dir` | `.acaua` | Store and runtime files |
+
+The default bind is loopback-only. Exposing the daemon on a network requires a
+reverse proxy with authentication. The API is documented in
+[architecture.md](architecture.md#api).
+
+## `acaua analyze`
+
+```bash
+acaua analyze /var/log/zeek/current
+acaua analyze /var/log/zeek/current --json
+```
+
+The directory is validated and a report is printed. In this skeleton the parser
+does not read Zeek records yet: `logs seen` and `records` are placeholders, and
+`alerts` is empty. The command is still useful to check path handling and the
+JSON shape.
+
+The future parser will support `conn.log`, `dns.log`, `ssl.log` and the protocol
+logs needed for identity and lateral-movement features. NetFlow/IPFIX is a
+degraded mode; it is not equivalent to full protocol logs.
+
+## `acaua doctor`
+
+```bash
+acaua doctor
+acaua doctor --json
+```
+
+Prints checks for Zeek, `curl`, `tar`, the optional DuckDB feature and the
+isolation of `research/`, followed by the status (`skeleton` in `0.1.0`). A
+missing optional dependency is reported as `falha` but does not abort the
+command. It does not send telemetry.
+
+## `acaua update`
+
+```bash
+acaua update
+acaua update --apply
+```
+
+`update` queries the latest Gitea Release, compares the tag with the running
+version and prints whether an update exists. `--apply` downloads the archive for
+the current platform, verifies its SHA-256, extracts it and replaces the
+`acaua` binary.
+
+Requirements: `curl` and `tar` on `PATH`, and a writable binary location. The
+updater refuses to replace any executable whose name is not `acaua`; the desktop
+app must be updated through its installer. A failed checksum leaves the current
+binary untouched.
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Success |
+| `1` | Runtime error (invalid path, failed update, I/O error) |
+| `2` | Invalid command-line usage (clap) |
+
+## Environment
+
+The skeleton has no required environment variable. `RUST_LOG` is reserved for
+the future tracing layer. The default data directory is relative to the current
+working directory; use an absolute path for a system service.
+
+## Examples
+
+```bash
+# Local lab
+acaua doctor
+acaua analyze ./fixtures/zeek --json
+acaua serve --bind 127.0.0.1:8787 --data-dir ./.acaua
+
+# Container
+docker run --rm -p 127.0.0.1:8787:8787 -v "$PWD/zeek:/data:ro" acaua serve
+```
+
+See [docker.md](docker.md) for the image and volume layout.