feat(install): 零输入一条命令部署 + 双架构发布包

- docker compose up -d 直接启动:entrypoint 在未显式提供密钥时自动生成随机
  JWT_SECRET/ENCRYPTION_KEY 并持久化到数据卷 .secrets.env(0600,重启不变),
  显式环境变量优先(单显式不被持久化文件覆盖,四场景实测);compose 去掉 :? 强制
- build.sh --dist / make dist:linux amd64 + arm64 两个 tar.gz(二进制+docs+homepage+README),
  实测 15M/13M;安装文档重写为三方式(kubernetes/install.sh 一键、compose 一条命令、release 包)
- README 快速开始同步

docker-compose.yml

@@ -53,12 +53,10 @@ services:
     environment:
       - SERVER_PORT=8080
       - DATA_DIR=/app/data
-      # P0: JWT_SECRET must be provided externally
-      # Set via .env file or shell export before running docker compose up.
-      # 注意：错误提示里不要内嵌 $(openssl ...)，否则会在 compose 解析时被执行。
-      - "JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required. Generate: openssl rand -hex 32, then: export JWT_SECRET=<value>}"
-      # P0: ENCRYPTION_KEY must be provided externally (AES-256, >=32 字符)
-      - "ENCRYPTION_KEY=${ENCRYPTION_KEY:?ENCRYPTION_KEY is required. Generate: openssl rand -hex 32, then: export ENCRYPTION_KEY=<value>}"
+      # 密钥零输入启动:不设置时 entrypoint 自动生成随机密钥并持久化到数据卷
+      # ($DATA_DIR/.secrets.env);需要固定密钥时在 .env / 环境变量里显式提供。
+      - "JWT_SECRET=${JWT_SECRET:-}"
+      - "ENCRYPTION_KEY=${ENCRYPTION_KEY:-}"
       # KUBECONFIG points to non-root user's .kube directory
       - KUBECONFIG=/home/lokistack/.kube/config