refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

CONTRIBUTING.md

@@ -2,8 +2,8 @@
 
 **English** · [Português](CONTRIBUTING.pt-BR.md)
 
-Thanks for helping. The project is a pre-alpha skeleton, so the most useful
-contributions right now are tests, fixtures, documentation and small,
+Thanks for helping. The project is an NDR engine built around deterministic evidence.
+The most useful contributions right now are tests, fixtures, documentation and small,
 well-scoped design corrections.
 
 1. **Authorized monitoring only.** Acauã is defensive software for networks you
@@ -15,26 +15,22 @@ well-scoped design corrections.
 3. **Be honest about what works.** If a feature is a stub, Linux-only or limited
    to one Zeek log, say so in the README, the CLI help and the test.
 4. **100% English codebase.** Source code, comments, scripts, workflows and
-   commit messages are English. The GUI and CLI remain bilingual (PT-BR and EN
+   commit messages are English. The web dashboard remains bilingual (PT-BR and EN
    through `i18n-en.js`).
 
 ## Workflow
 
 ```bash
 scripts/install-hooks.sh
+scripts/fetch-libduckdb.sh ~/.cache/acaua/duckdb
+export DUCKDB_LIB_DIR=~/.cache/acaua/duckdb LD_LIBRARY_PATH=~/.cache/acaua/duckdb
 scripts/check.sh
 scripts/check.sh --full
 ```
 
 `check.sh` runs formatting, clippy with warnings as errors, UI translation
-coverage, shell syntax, workflow YAML, SemVer consistency and the desktop check.
-`--full` adds workspace tests and `cargo audit`.
-
-The optional DuckDB feature is not part of the default check:
-
-```bash
-cargo check -p acaua-core --features duckdb
-```
+coverage, shell syntax, workflow YAML, SemVer consistency, DuckDB version pin
+verification and forbidden terms inspection. `--full` adds workspace tests and `cargo audit`.
 
 ## Research
 
@@ -42,18 +38,6 @@ cargo check -p acaua-core --features duckdb
 use astropy, scipy, networkx, pandas and notebooks. It must never be imported by
 the Rust runtime, copied into a release or required to build the product.
 
-## Detection rules
-
-- Keep reductions in a fixed order when floating-point results are part of an
-  alert.
-- Use a documented sentinel instead of `NaN` or a panic for degenerate inputs.
-- Use Jensen-Shannon, not raw KL, when a distribution can contain zero
-  probability.
-- Do not use JA4S/JA4H/JA4X/JA4SSH/JA4L by default: those variants carry a
-  non-OSI license. The client TLS JA4 fingerprint is the only default.
-- Long connections need their own detector; they do not produce the short
-  intervals a beaconing score expects.
-
 ## Interface and translation
 
 The interface source text is Portuguese. English comes from
@@ -70,11 +54,11 @@ when the word actually changes, as in `architecture.md` → `arquitetura.md`.
 
 Commits follow Conventional Commits 1.0.0 in English (`feat:`, `fix:`, `chore:`,
 `ci:`, `docs:`, `refactor:`, `test:`, `perf:`, `build:`). Versions follow SemVer
-2.0.0 and are synchronized across the workspace, the desktop manifest and the
-Tauri config.
+2.0.0.
 
-Pushing a `v*` tag creates a Gitea Release from the matching `CHANGELOG.md`
-section and attaches the Linux CLI packages plus the desktop bundles.
+Releases are published as multi-arch container images (`linux/amd64` and `linux/arm64`)
+to the Gitea registry. Pushing a `v*` tag creates a Gitea Release from the matching
+`CHANGELOG.md` section and tags the existing container image.
 
 ## License