refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

scripts/fetch-libduckdb.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Installs the official prebuilt DuckDB shared library (libduckdb.so and
+# duckdb.h) for the current CPU architecture into <dest-dir>, after checking
+# its SHA-256. DuckDB is never compiled from source in this project.
+#
+#   scripts/fetch-libduckdb.sh <dest-dir>
+#
+# Then build with DUCKDB_LIB_DIR=<dest-dir> and run tests or the binary with
+# LD_LIBRARY_PATH=<dest-dir> (the Docker image uses ldconfig instead).
+#
+# The pinned version MUST match the duckdb crate in Cargo.lock: duckdb-rs
+# encodes the DuckDB version in its second component (DuckDB 1.5.6 <-> duckdb
+# 1.10506.x); scripts/check.sh enforces this. To upgrade, change the version
+# and both checksums together (from the "digest" field of each asset in
+# https://api.github.com/repos/duckdb/duckdb/releases/tags/v<version>).
+# DuckDB 2.x renamed these assets to duckdb-shared-libs-linux-<arch>.tar.gz.
+set -euo pipefail
+
+DUCKDB_VERSION=1.5.6
+dest=${1:?usage: fetch-libduckdb.sh <dest-dir>}
+
+case "$(uname -m)" in
+  x86_64 | amd64) arch=amd64 sha256=b845005f5132a7d8180057c35e14a7626632258782f871a90861b19c1c03841b ;;
+  aarch64 | arm64) arch=arm64 sha256=b72ed9f05003f5e9d2015f7ceada6416b377d9dd33169cdde3c9e33897856eee ;;
+  *) echo "fetch-libduckdb: unsupported architecture: $(uname -m)" >&2; exit 1 ;;
+esac
+stamp="$DUCKDB_VERSION-linux-$arch"
+
+installed() { [ -f "$dest/libduckdb.so" ] && [ "$(cat "$dest/.duckdb-release" 2>/dev/null)" = "$stamp" ]; }
+if installed; then
+  echo "libduckdb $stamp already in $dest"
+  exit 0
+fi
+
+command -v unzip >/dev/null || { echo "fetch-libduckdb: unzip is required" >&2; exit 1; }
+parent=$(dirname "$dest")
+mkdir -p "$parent"
+# Stage next to the destination so the final rename is atomic: parallel CI
+# jobs sharing /opt/hostedtoolcache never see a half-extracted library.
+stage=$(mktemp -d "$parent/.libduckdb.XXXXXX")
+trap 'rm -rf "$stage"' EXIT
+asset="libduckdb-linux-$arch.zip"
+curl -fsSL --retry 3 -o "$stage/$asset" \
+  "https://github.com/duckdb/duckdb/releases/download/v$DUCKDB_VERSION/$asset"
+echo "$sha256  $stage/$asset" | sha256sum -c --quiet - \
+  || { echo "fetch-libduckdb: checksum mismatch for $asset" >&2; exit 1; }
+# The archive also carries libduckdb_static.a (~80 MB) and duckdb.hpp; only the
+# shared library and the C header are needed.
+unzip -o -j -q "$stage/$asset" libduckdb.so duckdb.h -d "$stage/lib"
+echo "$stamp" > "$stage/lib/.duckdb-release"
+if ! mv -T "$stage/lib" "$dest" 2>/dev/null; then
+  # Either another job just installed the same release, or an older one is there.
+  installed || { rm -rf "$dest" && mv -T "$stage/lib" "$dest"; }
+fi
+echo "libduckdb $stamp installed in $dest"