refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

ROADMAP.md

@@ -3,23 +3,22 @@
 **English** · [Português](ROADMAP.pt-BR.md)
 
 This roadmap separates what exists from what is planned. The four pillars are
-**not implemented** in `0.1.0`; they are the next body of work.
+**under development**; they represent the core analytical work.
 
 ## Done
 
 - Rust workspace with `acaua-core` and `acaua-cli`.
-- CLI skeleton, Axum API skeleton and embedded vanilla UI.
-- Tauri desktop shell with language and theme settings.
-- Stubs for the four pillars, evidence fusion, storage, Zeek ingestion and the
-  Gitea-based updater.
+- CLI commands, Axum API and embedded web dashboard.
+- 100% Docker containerization, compose deployment, non-root hardened profile.
+- Prebuilt DuckDB linking and Parquet storage foundations.
+- Stubs for the four pillars, evidence fusion, and Zeek ingestion.
 - English/Portuguese documentation, CI/release workflows and `scripts/check.sh`.
-- Deterministic smoke tests and a bilingual UI check.
+- Deterministic smoke tests and bilingual UI coverage checks.
 
 ## Next
 
 1. **Pillar 1 — beaconing.** Implement the Rayleigh/Schuster periodogram on
-   event timestamps, add generalized Lomb–Scargle only when a real `y` exists,
-   and ship golden fixtures with fixed expected values.
+   event timestamps, add harmonic resistance, and verify with deterministic fixtures.
 2. **Pillar 2 — persistent sessions.** Detect long connections that never
    produce a short interval, with explicit thresholds and no overlap with
    pillar 1.
@@ -33,9 +32,8 @@ This roadmap separates what exists from what is planned. The four pillars are
 - Pillar 3 — deterministic protocol anomalies, including identity and
   lateral-movement features.
 - Pillar 4 — bounded, symmetric fusion with reproducible weights.
-- DuckDB/Parquet storage behind the optional `duckdb` feature, with a seven-day
-  TTL and an export command.
-- Desktop dataset view, alert detail with evidence, and scheduled `serve` runs.
+- Analytical store optimizations, daily Parquet partitioning and TTL pruning.
+- Scheduled ingestion and automated log rotation handling in daemon mode.
 - NetFlow/IPFIX as a documented degraded mode and Suricata EVE JSON as an
   optional secondary input.
 - Signed release metadata, SBOM and reproducible builds.
@@ -46,10 +44,4 @@ This roadmap separates what exists from what is planned. The four pillars are
 - A required cloud service or telemetry pipeline.
 - Python in the shipped runtime.
 - Treating flow records as equivalent to full Zeek protocol logs.
-- Automatic desktop self-update.
-
-## Versioning
-
-The project follows SemVer 2.0.0. `0.x` means the API and detection output may
-change between minor versions. A `1.0.0` release will require stable evidence
-format, documented thresholds and a migration path for stored data.
+- Native desktop shell or binary self-mutation.