refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

SECURITY.md

@@ -15,6 +15,9 @@ reproduction when a private channel is available.
 
 ## Scope and threat model
 
+- **Container hardening:** the container runs as an unprivileged user (`acaua`, UID 10001),
+  with a read-only root filesystem (`read_only: true`), all capabilities dropped
+  (`cap_drop: [ALL]`), and security hardening (`no-new-privileges:true`).
 - **Input parsing:** a malformed log line must not panic the daemon, exhaust
   memory or escape the configured data directory.
 - **Path handling:** dataset paths are resolved and confined to the configured
@@ -25,18 +28,18 @@ reproduction when a private channel is available.
 - **Evidence integrity:** alert evidence must be reproducible from the same
   input and code version. Silent nondeterminism is a correctness and security
   issue.
-- **Updates:** the CLI checks Gitea Releases, downloads over HTTPS and verifies
-  SHA-256 before replacing the binary. The desktop app does not update itself.
+- **Updates:** updates are delivered as verified multi-arch container images.
+  The daemon terminates gracefully upon receiving `SIGTERM` without data corruption.
 - **Privacy:** there is no telemetry. Retention defaults to seven days of
   normalized events; the operator is responsible for local law and policy.
 
 ## Out of scope
 
-- Vulnerabilities in third-party Zeek, Suricata, Tauri or operating-system
-  packages that are already fixed upstream.
+- Vulnerabilities in third-party Zeek, DuckDB or operating-system packages
+  that are already fixed upstream.
 - Attacks that require the operator to disable the documented security controls
   (for example, running `serve` as root on a public interface).
-- Detection quality claims: the pillars are not implemented in this skeleton.
+- Detection quality claims: the pillars are defensive heuristics, not absolute guarantees.
 
 ## Supported versions