refactor: distribute Acaua as a Docker image instead of a desktop app

Acaua is a collective SOC daemon consuming only Zeek log files, not a
single-user tool needing local hardware like its siblings. Drop the
Tauri desktop shell, installers and self-update entirely; the server
and its web dashboard ship as a container, updated by pulling a new
image tag.

Link against the official prebuilt libduckdb instead of compiling it
from source via the bundled feature, cutting image build time from
15+ minutes to about 3. Fix a real bug found along the way: as PID 1
in a container, the daemon ignored SIGTERM and was always killed
after the stop timeout; it now shuts down gracefully.

Also corrects the Pillar 1 beaconing score: the period estimate had a
harmonic alias (a perfectly periodic 4h series resolved to 600s), and
the old score formula flagged pure random traffic as suspicious
(p95 = 0.839 on Poisson noise). The new formula was validated against
300 samples per scenario.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

scripts/smoke-image.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Smoke-tests an Acauã image: the API and the dashboard answer, libduckdb is
+# linked, a HEALTHCHECK is declared and SIGTERM stops the daemon cleanly.
+# Everything runs through `docker exec`, so no port has to be reachable from
+# the CI job container. The container is always removed.
+#
+#   scripts/smoke-image.sh <image-ref>
+set -euo pipefail
+
+image=${1:?usage: smoke-image.sh <image-ref>}
+name="acaua-smoke-$$-$RANDOM"
+trap 'docker rm -f "$name" >/dev/null 2>&1 || true' EXIT
+fail() { echo "smoke: $*" >&2; docker logs "$name" >&2 2>&1 || true; exit 1; }
+
+docker run -d --name "$name" "$image" >/dev/null
+for _ in $(seq 1 30); do
+  docker exec "$name" curl -fsS http://127.0.0.1:8787/api/health >/dev/null 2>&1 && break
+  sleep 1
+done
+docker exec "$name" curl -fsS http://127.0.0.1:8787/api/health | grep -q '"status":"ok"' || fail "/api/health did not answer"
+docker exec "$name" curl -fsS http://127.0.0.1:8787/ | grep -qi '<!doctype html' || fail "dashboard is not served"
+docker exec "$name" acaua doctor --json | grep -A1 '"name": "duckdb"' | grep -q '"ok": true' || fail "libduckdb is not usable"
+[ "$(docker inspect -f '{{if .Config.Healthcheck}}yes{{end}}' "$name")" = yes ] || fail "image has no HEALTHCHECK"
+[ "$(docker exec "$name" id -u)" != 0 ] || fail "daemon runs as root"
+docker stop -t 10 "$name" >/dev/null
+code=$(docker inspect -f '{{.State.ExitCode}}' "$name")
+[ "$code" = 0 ] || fail "exit code $code after SIGTERM (expected 0: SIGTERM must stop serve)"
+echo "smoke: $image ok"