refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

docker-compose.yml

@@ -1,23 +1,45 @@
+# Acauã stack: Zeek captures traffic and writes hourly-rotated logs; Acauã
+# reads them read-only and serves the API and the web dashboard.
+#
+#   cp .env.example .env              # set ZEEK_INTERFACE (authorized network only)
+#   docker compose pull && docker compose up -d      # operators: published image
+#   docker compose up -d --build                     # developers: build locally
+name: acaua
+
 services:
   zeek:
-    image: zeek/zeek:latest
+    image: ${ZEEK_IMAGE:-zeek/zeek:9.0.1}
     network_mode: host
-    cap_add:
-      - NET_RAW
-      - NET_ADMIN
-    environment:
-      ZEEK_INTERFACE: ${ZEEK_INTERFACE:-eth0}
-    command: ["zeek", "-i", "${ZEEK_INTERFACE:-eth0}", "Log::default_logdir=/logs"]
+    cap_drop: [ALL]
+    cap_add: [NET_RAW, NET_ADMIN]
+    working_dir: /logs
+    command:
+      - zeek
+      - -i
+      - ${ZEEK_INTERFACE:-eth0}
+      - Log::default_logdir=/logs
+      - Log::default_rotation_interval=1hr
+      - Log::default_rotation_dir=/logs/archive
     volumes:
-      - ./data/zeek:/logs
+      - zeek-logs:/logs
     restart: unless-stopped
 
   acaua:
+    image: ${ACAUA_IMAGE:-git.lucasrguerra.dev.br/ciberfauna/acaua}:${ACAUA_VERSION:-latest}
     build: .
-    command: ["serve", "--bind", "0.0.0.0:8787", "--data-dir", "/data/acaua"]
     ports:
-      - "127.0.0.1:8787:8787"
+      - "${ACAUA_PUBLISH:-127.0.0.1:8787}:8787"
     volumes:
-      - ./data/zeek:/data/zeek:ro
-      - ./data/acaua:/data/acaua
+      - zeek-logs:/data/zeek:ro
+      - acaua-data:/data/acaua
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
     restart: unless-stopped
+
+volumes:
+  zeek-logs:
+  acaua-data: