refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

crates/acaua-cli/src/web.rs

@@ -75,16 +75,19 @@ async fn alerts() -> Json<Vec<Alert>> {
 }
 
 async fn analyze(
+    State(state): State<AppState>,
     Json(request): Json<AnalyzeRequest>,
 ) -> std::result::Result<Json<AnalysisReport>, (StatusCode, Json<ErrorBody>)> {
-    zeek::analyze_dir(&request.path).map(Json).map_err(|error| {
-        (
-            StatusCode::BAD_REQUEST,
-            Json(ErrorBody {
-                error: error.to_string(),
-            }),
-        )
-    })
+    zeek::analyze_dir(&request.path, state.storage.root())
+        .map(Json)
+        .map_err(|error| {
+            (
+                StatusCode::BAD_REQUEST,
+                Json(ErrorBody {
+                    error: error.to_string(),
+                }),
+            )
+        })
 }
 
 async fn update_check() -> std::result::Result<Json<UpdateStatus>, (StatusCode, Json<ErrorBody>)> {
@@ -100,15 +103,6 @@ async fn update_check() -> std::result::Result<Json<UpdateStatus>, (StatusCode,
         })
 }
 
-async fn update_apply() -> (StatusCode, Json<ErrorBody>) {
-    (
-        StatusCode::NOT_IMPLEMENTED,
-        Json(ErrorBody {
-            error: "update --apply is only available through the acaua CLI".to_string(),
-        }),
-    )
-}
-
 async fn logo() -> impl IntoResponse {
     ([(header::CONTENT_TYPE, "image/png")], Body::from(LOGO))
 }
@@ -129,21 +123,38 @@ async fn asset(uri: Uri) -> Response {
 }
 
 async fn shutdown_signal() {
-    let _ = tokio::signal::ctrl_c().await;
+    let interrupt = async {
+        let _ = tokio::signal::ctrl_c().await;
+    };
+    #[cfg(unix)]
+    let terminate = async {
+        match tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()) {
+            Ok(mut stream) => {
+                stream.recv().await;
+            }
+            Err(_) => std::future::pending::<()>().await,
+        }
+    };
+    #[cfg(not(unix))]
+    let terminate = std::future::pending::<()>();
+    tokio::select! {
+        _ = interrupt => {}
+        _ = terminate => {}
+    }
 }
 
 pub async fn serve(bind: &str, data_dir: PathBuf) -> Result<()> {
     let _ = tracing_subscriber::fmt().try_init();
     std::fs::create_dir_all(&data_dir)?;
     let state = AppState {
-        storage: Arc::new(Storage::open(&data_dir)),
+        storage: Arc::new(Storage::open(&data_dir)?),
     };
     let app = Router::new()
         .route("/api/health", get(health))
         .route("/api/status", get(status))
         .route("/api/alerts", get(alerts))
         .route("/api/analyze", post(analyze))
-        .route("/api/update", get(update_check).post(update_apply))
+        .route("/api/update", get(update_check))
         .route("/logo.png", get(logo))
         .fallback(asset)
         .with_state(state)