refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

docs/cli.md

@@ -2,23 +2,22 @@
 
 **English** · [Português](pt-BR/cli.md)
 
-The `acaua` binary is both the CLI and the daemon. This page describes the
-commands that exist in the `0.1.0` skeleton. Detection is not implemented yet;
-`analyze` validates input and returns a stub report.
+The `acaua` binary serves both as the CLI command runner and the background daemon.
+This page describes the commands available in the engine.
 
 ```text
 acaua <command> [options]
 
 Commands:
-  serve    Start the API and embedded UI
+  serve    Start the API and embedded web dashboard
   analyze  Analyze a Zeek log directory
   doctor   Check the local environment
-  update   Check or apply a CLI update
+  update   Check for available releases
 ```
 
 ## `acaua serve`
 
-Starts the HTTP API and the embedded UI.
+Starts the HTTP API and the embedded web dashboard.
 
 ```bash
 acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
@@ -40,14 +39,8 @@ acaua analyze /var/log/zeek/current
 acaua analyze /var/log/zeek/current --json
 ```
 
-The directory is validated and a report is printed. In this skeleton the parser
-does not read Zeek records yet: `logs seen` and `records` are placeholders, and
-`alerts` is empty. The command is still useful to check path handling and the
-JSON shape.
-
-The future parser will support `conn.log`, `dns.log`, `ssl.log` and the protocol
-logs needed for identity and lateral-movement features. NetFlow/IPFIX is a
-degraded mode; it is not equivalent to full protocol logs.
+Validates the target directory, ingests `conn.log` traffic into Parquet partitions,
+and runs threat detection algorithms.
 
 ## `acaua doctor`
 
@@ -56,52 +49,34 @@ acaua doctor
 acaua doctor --json
 ```
 
-Prints checks for Zeek, `curl`, `tar`, the optional DuckDB feature and the
-isolation of `research/`, followed by the status (`skeleton` in `0.1.0`). A
-missing optional dependency is reported as `falha` but does not abort the
-command. It does not send telemetry.
+Runs environment checks:
+- `zeek`: verifies `zeek --version` or detects containerized execution (`ACAUA_RUNTIME=container`).
+- `curl`: confirms HTTP download availability.
+- `duckdb`: confirms dynamic linkage against `libduckdb.so` in runtime.
+- `research`: verifies that the research workspace remains isolated.
 
 ## `acaua update`
 
 ```bash
 acaua update
-acaua update --apply
 ```
 
-`update` queries the latest Gitea Release, compares the tag with the running
-version and prints whether an update exists. `--apply` downloads the archive for
-the current platform, verifies its SHA-256, extracts it and replaces the
-`acaua` binary.
-
-Requirements: `curl` and `tar` on `PATH`, and a writable binary location. The
-updater refuses to replace any executable whose name is not `acaua`; the desktop
-app must be updated through its installer. A failed checksum leaves the current
-binary untouched.
+Queries the Gitea Releases API, compares the latest tag against the running
+version, and prints upgrade instructions (`docker compose pull && docker compose up -d`
+when running inside a container).
 
 ## Exit codes
 
 | Code | Meaning |
 |---|---|
 | `0` | Success |
-| `1` | Runtime error (invalid path, failed update, I/O error) |
+| `1` | Runtime error (invalid path, query error, I/O error) |
 | `2` | Invalid command-line usage (clap) |
 
 ## Environment
 
-The skeleton has no required environment variable. `RUST_LOG` is reserved for
-the future tracing layer. The default data directory is relative to the current
-working directory; use an absolute path for a system service.
-
-## Examples
-
-```bash
-# Local lab
-acaua doctor
-acaua analyze ./fixtures/zeek --json
-acaua serve --bind 127.0.0.1:8787 --data-dir ./.acaua
-
-# Container
-docker run --rm -p 127.0.0.1:8787:8787 -v "$PWD/zeek:/data:ro" acaua serve
-```
-
-See [docker.md](docker.md) for the image and volume layout.
+| Variable | Meaning |
+|---|---|
+| `ACAUA_RUNTIME` | Set to `container` inside Docker images to adapt service checks |
+| `DUCKDB_LIB_DIR` | Path to directory containing `libduckdb.so` when compiling natively |
+| `LD_LIBRARY_PATH` | Shared library load path for `libduckdb.so` outside standard paths |