refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

.gitea/workflows/ci.yml

@@ -2,11 +2,9 @@ name: CI
 
 on:
   # Documentation-only or local agent state changes do not trigger CI jobs.
-  push:
-    branches: [main]
-    paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', 'scripts/release-upload.sh', '.gitea/workflows/release.yml']
   pull_request:
-    paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', 'scripts/release-upload.sh', '.gitea/workflows/release.yml']
+    paths-ignore: ['**.md', 'docs/**', 'LICENSE*', '.gitignore', '.githooks/**', '.wolf/**', '.claude/**', '.opencode/**', '.codex/**', '.cursor/**', '.superpowers/**', '.superset/**', '.gitea/ISSUE_TEMPLATE/**', 'scripts/release-notes.sh', '.gitea/workflows/release.yml']
+  workflow_call:
 
 concurrency:
   group: ci-${{ gitea.ref }}
@@ -22,6 +20,11 @@ env:
   CARGO_HOME: /opt/hostedtoolcache/cargo
   RUSTUP_HOME: /opt/hostedtoolcache/rustup
   NPM_CONFIG_CACHE: /opt/hostedtoolcache/npm-cache
+  # Prebuilt libduckdb (scripts/fetch-libduckdb.sh), cached on the persistent
+  # runner volume. Every CI job runs on linux-arm64.
+  DUCKDB_LIB_DIR: /opt/hostedtoolcache/duckdb/linux-arm64
+  DUCKDB_INCLUDE_DIR: /opt/hostedtoolcache/duckdb/linux-arm64
+  LD_LIBRARY_PATH: /opt/hostedtoolcache/duckdb/linux-arm64
 
 jobs:
   lint:
@@ -39,6 +42,10 @@ jobs:
           node-version: 22
       - name: UI translation coverage
         run: node scripts/check-ui-i18n.mjs
+      - name: Prebuilt libduckdb
+        run: |
+          command -v unzip >/dev/null || scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/unzip unzip
+          scripts/fetch-libduckdb.sh "$DUCKDB_LIB_DIR"
       - run: cargo fmt --all -- --check
       - run: cargo clippy --workspace --all-targets
 
@@ -51,6 +58,10 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
+      - name: Prebuilt libduckdb
+        run: |
+          command -v unzip >/dev/null || scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/unzip unzip
+          scripts/fetch-libduckdb.sh "$DUCKDB_LIB_DIR"
       - run: cargo test --workspace
 
   audit:
@@ -67,22 +78,16 @@ jobs:
           command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
           cargo audit
 
-  gui:
-    name: Check desktop app (Linux)
+  image:
+    name: Docker image (build and smoke test)
+    if: ${{ gitea.event_name == 'pull_request' }}
     runs-on: linux-arm64
-    env:
-      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/acaua-gui
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-      - name: Tauri system dependencies
-        timeout-minutes: 25
-        run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-native libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
-      - name: Generate icons
-        run: npx --yes @tauri-apps/cli@2 icon apps/gui/src-tauri/icons/source.png -o apps/gui/src-tauri/icons
-      - run: cargo check --manifest-path apps/gui/src-tauri/Cargo.toml
-        env:
-          RUSTFLAGS: ""
+      - name: Build
+        run: docker build -t "acaua-ci:${{ gitea.run_id }}" .
+      - name: Smoke test
+        run: scripts/smoke-image.sh "acaua-ci:${{ gitea.run_id }}"
+      - name: Clean up
+        if: always()
+        run: docker rmi -f "acaua-ci:${{ gitea.run_id }}" >/dev/null 2>&1 || true