refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

crates/acaua-core/Cargo.toml

@@ -8,17 +8,17 @@ repository.workspace = true
 authors.workspace = true
 rust-version.workspace = true
 
-[features]
-default = []
-duckdb = ["dep:duckdb"]
-
 [dependencies]
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
 thiserror = "1"
 time = { version = "0.3", features = ["formatting", "macros"] }
-duckdb = { version = "1", features = ["bundled"], optional = true }
+chrono = { version = "0.4", default-features = false, features = ["std"] }
+# Linked against the official prebuilt libduckdb (scripts/fetch-libduckdb.sh):
+# never enable `bundled`, `parquet`, `json` or `extensions-full`, which compile
+# DuckDB from source. Parquet, JSON and ICU are already inside libduckdb.so.
+duckdb = "~1.10506.1"
 
 [dev-dependencies]
 tempfile = "3"