feat(install): 零输入一条命令部署 + 双架构发布包

- docker compose up -d 直接启动:entrypoint 在未显式提供密钥时自动生成随机
  JWT_SECRET/ENCRYPTION_KEY 并持久化到数据卷 .secrets.env(0600,重启不变),
  显式环境变量优先(单显式不被持久化文件覆盖,四场景实测);compose 去掉 :? 强制
- build.sh --dist / make dist:linux amd64 + arm64 两个 tar.gz(二进制+docs+homepage+README),
  实测 15M/13M;安装文档重写为三方式(kubernetes/install.sh 一键、compose 一条命令、release 包)
- README 快速开始同步

docker-entrypoint.sh

@@ -20,6 +20,43 @@ if [ -n "${ENCRYPTION_KEY_FILE:-}" ] && [ -r "$ENCRYPTION_KEY_FILE" ]; then
     export ENCRYPTION_KEY
 fi
 
+# ---- 零输入启动:未显式提供密钥时自动生成并持久化到数据卷 ----
+# docker compose up -d 即可启动;生成的密钥保存在 $DATA_DIR/.secrets.env
+# (0600),重启/升级不变。需要固定密钥或接入密钥管理时,显式设置环境变量即可覆盖。
+AUTO_SECRETS_FILE="${DATA_DIR:-/app/data}/.secrets.env"
+if [ -z "${JWT_SECRET:-}" ] || [ -z "${ENCRYPTION_KEY:-}" ]; then
+    # 先保存显式传入的值:source 持久化文件时不能覆盖用户显式配置
+    EXPLICIT_JWT="${JWT_SECRET:-}"
+    EXPLICIT_ENC="${ENCRYPTION_KEY:-}"
+    if [ -r "$AUTO_SECRETS_FILE" ]; then
+        # shellcheck disable=SC1090
+        . "$AUTO_SECRETS_FILE"
+    fi
+    [ -n "$EXPLICIT_JWT" ] && JWT_SECRET="$EXPLICIT_JWT"
+    [ -n "$EXPLICIT_ENC" ] && ENCRYPTION_KEY="$EXPLICIT_ENC"
+    CHANGED=0
+    gen_secret() { head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n'; }
+    if [ -z "${JWT_SECRET:-}" ]; then
+        JWT_SECRET="$(gen_secret)"
+        CHANGED=1
+        echo "==> JWT_SECRET not provided; generated and persisted to $AUTO_SECRETS_FILE"
+    fi
+    if [ -z "${ENCRYPTION_KEY:-}" ]; then
+        ENCRYPTION_KEY="$(gen_secret)"
+        CHANGED=1
+        echo "==> ENCRYPTION_KEY not provided; generated and persisted to $AUTO_SECRETS_FILE"
+    fi
+    export JWT_SECRET ENCRYPTION_KEY
+    if [ "$CHANGED" = "1" ]; then
+        umask 077
+        {
+            echo "# Auto-generated by lokistack entrypoint. Remove to regenerate."
+            echo "JWT_SECRET=$JWT_SECRET"
+            echo "ENCRYPTION_KEY=$ENCRYPTION_KEY"
+        } > "$AUTO_SECRETS_FILE"
+    fi
+fi
+
 # ---- Runtime security validation ----
 MISSING_VARS=()