refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

docs/support.md

@@ -2,46 +2,36 @@
 
 **English** · [Português](pt-BR/suporte.md)
 
-Acauã is pre-alpha. There is no support contract and no published binary yet.
-The fastest way to get help is a focused issue in the Gitea repository.
+Acauã is distributed as a containerized NDR engine. The fastest way to get help
+is opening an issue in the Gitea repository.
 
 ## Before opening an issue
 
-1. Run `acaua doctor --json` and keep the output.
+1. Run `acaua doctor --json` inside the container (`docker exec acaua acaua doctor --json`) or host.
 2. Confirm the version with `acaua --version`.
-3. Try the smallest input that reproduces the problem.
-4. Read the [known limits](../README.md#known-limits) and
-   [architecture](architecture.md).
+3. Try reproducing with the smallest possible Zeek log capture.
+4. Review the [known limits](../README.md#known-limits) and [architecture](architecture.md).
 
 ## What to include
 
-- Operating system, architecture and Acauã version.
-- The exact command and the full terminal output.
-- Whether the input is a Zeek log directory, a synthetic fixture or a capture.
-- For a UI problem: browser or desktop build, language and theme.
-- For an update problem: `acaua update` output and whether `curl` and `tar` are
-  on `PATH`.
+- Host operating system, architecture (`uname -m`) and Acauã version/tag.
+- The exact command or Docker Compose definition.
+- Full container logs (`docker compose logs acaua`).
+- Redacted Zeek log samples demonstrating the issue.
 
-Do not attach production captures or credentials. Redact addresses, hostnames
-and payloads before sharing.
+Do not attach production captures or credentials. Redact IP addresses, hostnames
+and sensitive payloads before sharing.
 
 ## Security issues
 
 Do not include exploit details in a public issue. Follow
-[SECURITY.md](../SECURITY.md) and ask for a private channel first.
+[SECURITY.md](../SECURITY.md) and request a private communication channel.
 
 ## Common situations
 
 | Symptom | What to check |
 |---|---|
-| `analyze` returns zero records | Expected in `0.1.0`; the parser is a stub |
-| `serve` is unreachable from another machine | It binds to loopback by default |
-| `update` fails | `curl`, `tar`, write permission and release assets |
-| Desktop build fails | Tauri system dependencies for the platform |
-| UI shows Portuguese | `Auto` follows the system language; choose English in settings |
-
-## Scope
-
-Support covers the Acauã code and documentation. It does not cover Zeek or
-Suricata configuration, network capture legality, or third-party distribution
-packages. Use only on networks you own or are authorized to monitor.
+| Container fails to start | Confirm `libduckdb.so` linkage via `docker logs` and verify permissions on named volumes |
+| `serve` is unreachable from another host | Service binds to loopback (`127.0.0.1:8787`) by default; verify reverse proxy configuration |
+| `update` fails | Check network connectivity to Gitea Releases API or verify registry pull permissions |
+| Web UI shows Portuguese | `Auto` follows the browser language; select English in settings |