refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

README.md

@@ -26,9 +26,8 @@ not an opaque model. The goal is to answer not only "this looks suspicious" but
   for identity and lateral-movement analysis. NetFlow/IPFIX is a documented
   degraded mode, never presented as equivalent. Suricata EVE JSON is an optional
   secondary input.
-- **Daemon and desktop:** `acaua serve` runs continuous ingestion, scheduling,
-  the API and the embedded UI; the Tauri app opens a local dataset or talks to a
-  remote `serve`.
+- **Server daemon and web dashboard:** `acaua serve` runs continuous ingestion,
+  scheduling, the API and the embedded web UI, distributed 100% via Docker.
 - **Research stays outside the product:** `research/` is an isolated Python
   workspace for scientific validation and fixtures. It is never compiled,
   packaged or released.
@@ -39,11 +38,12 @@ not an opaque model. The goal is to answer not only "this looks suspicious" but
 |---|---|
 | Rust workspace and CLI stubs | ✅ compiles |
 | Axum API with health, status, alerts and analyze routes | ✅ stub |
-| Desktop shell and vanilla UI | ✅ shell, no real screenshots |
+| Embedded web dashboard | ✅ UI shell, served by daemon |
 | Documentation and CI/release workflows | ✅ |
+| Docker multi-arch image and compose deployment | ✅ |
+| DuckDB analytical store | ✅ official prebuilt library linked |
 | Four detection pillars | 🚧 under development |
 | Zeek log parser | 🚧 stub |
-| DuckDB/Parquet storage and 7-day TTL | 🚧 reserved, feature disabled by default |
 | Alert evidence and scoring | 🚧 stub |
 | Published releases | ❌ none yet |
 
@@ -70,20 +70,34 @@ Acauã is defensive software for networks you own or are explicitly authorized
 to monitor. Capturing or analyzing third-party traffic without permission may
 be illegal. The operator is responsible for scope, privacy and retention.
 
-The daemon binds to `127.0.0.1` by default. The optional Docker deployment is
-documented for lab and research use.
+The daemon binds to `127.0.0.1` by default. The Docker Compose deployment
+isolates the daemon in an unprivileged, read-only container with dropped capabilities.
 
 ## Install
 
-There are no published releases yet. Build from source:
+Run via Docker Compose (recommended for operators):
 
 ```bash
+cp .env.example .env
+docker compose pull && docker compose up -d
+```
+
+Or build and run locally with Docker:
+
+```bash
+docker compose up -d --build
+```
+
+To compile from source natively (Rust 1.88+ required):
+
+```bash
+scripts/fetch-libduckdb.sh ~/.cache/acaua/duckdb
+export DUCKDB_LIB_DIR=~/.cache/acaua/duckdb LD_LIBRARY_PATH=~/.cache/acaua/duckdb
 cargo build --release -p acaua-cli
 ./target/release/acaua --help
 ```
 
-Rust 1.80+ is required. The desktop app needs the Tauri system dependencies for
-your platform.
+Supported platform matrix for published container images: `linux/amd64` and `linux/arm64`.
 
 ## Getting started
 
@@ -95,39 +109,29 @@ acaua update
 ```
 
 `analyze` currently validates the directory and returns a skeleton report; it
-does not parse Zeek logs yet. `serve` exposes the stub API and the embedded UI.
-`update` uses the same Gitea Releases + SHA-256 model as Guará and Sabiá.
-
-## Desktop app
-
-The Tauri app is a shell for the same UI used by `serve`. It has a dashboard for
-the four pillars, a dataset path field, an alerts panel and settings for language
-and theme. It does **not** render detection results yet. See
-**[docs/interface.md](docs/interface.md)**.
+does not parse Zeek logs yet. `serve` exposes the stub API and the embedded web UI.
+`update` checks for new versions and guides container image updates.
 
 ## Development
 
 ```bash
+scripts/fetch-libduckdb.sh ~/.cache/acaua/duckdb
+export DUCKDB_LIB_DIR=~/.cache/acaua/duckdb LD_LIBRARY_PATH=~/.cache/acaua/duckdb
 cargo test --workspace
 cargo clippy --workspace --all-targets
 node scripts/check-ui-i18n.mjs
-scripts/check.sh
+scripts/check.sh --full
 ```
 
-The optional DuckDB backend is compiled with `--features duckdb`; it is disabled
-by default so the skeleton stays fast to check. See
-**[CONTRIBUTING.md](CONTRIBUTING.md)** and
-**[docs/architecture.md](docs/architecture.md)**.
+See **[CONTRIBUTING.md](CONTRIBUTING.md)** and **[docs/architecture.md](docs/architecture.md)**.
 
 ## Known limits
 
 - The detection engine, Zeek parser and storage layer are stubs.
-- There is no published binary, installer or release asset.
-- The GUI has no real screenshots because there is nothing to render yet.
+- There is no published release image yet.
 - NetFlow/IPFIX is a degraded input mode by design; it cannot replace the Zeek
   protocol logs for every pillar.
-- The project targets Linux for the daemon and the CI release pipeline. The
-  desktop app follows the same Tauri platform matrix as the sibling projects.
+- The project targets Linux container environments (`linux/amd64`, `linux/arm64`).
 
 ## Where it's going
 
@@ -135,9 +139,9 @@ Summary of the [ROADMAP](ROADMAP.md):
 
 | | |
 |---|---|
-| **Done** | Workspace, CLI/API stubs, GUI shell, documentation, CI/release workflows |
+| **Done** | Workspace, CLI/API stubs, web dashboard, Docker containerization, CI/release workflows |
 | **Next** | Pillar 1 and 2 implementations with deterministic fixtures; real Zeek parser |
-| **Later** | DuckDB/Parquet storage, TTL, pillar 3 and 4, evidence fusion, desktop dataset view |
+| **Later** | Full Parquet partitioning, TTL pruning, pillar 3 and 4, evidence fusion |
 | **Not planned** | Opaque AI scoring, a required cloud service, Python in the shipped runtime |
 
 ## License