refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

.env.example

@@ -1,2 +1,9 @@
-# Interface captured by the Compose Zeek service. Use only on an authorized network.
+# Interface captured by the Zeek service. Use only on a network you are authorized to monitor.
 ZEEK_INTERFACE=eth0
+# Acauã image tag: latest (last release), X.Y.Z / X.Y (pinned), or edge (main).
+ACAUA_VERSION=latest
+# Host address and port of the dashboard. Keep it on loopback unless an
+# authenticating reverse proxy sits in front of it.
+ACAUA_PUBLISH=127.0.0.1:8787
+# Zeek image, pinned to an exact version.
+ZEEK_IMAGE=zeek/zeek:9.0.1