web/deploy: add one-shot install.sh

Adds web/deploy/install.sh — full LXC setup in one command. It derives the
repo path from its own location (clone anywhere; /opt/ponfw recommended),
installs git/node/npm if missing (checks Node >= 18), creates the ponfw
service user, runs npm install --omit=dev, writes /etc/pon-fleet-web.env on
first run, and installs+enables the systemd unit with WorkingDirectory set to
the checkout. Idempotent; warns if cloned under /home (ProtectHome blocks it).

README + CLAUDE.md §16 updated to lead with install.sh and clarify the clone
location.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/README.md

@@ -78,34 +78,38 @@ caller's MCMS-host snapshots.
 
 ## Deploy on a Debian 13 LXC (clone-to-run)
 
-Files in `web/deploy/`: a systemd unit, an env template, and `update.sh`.
+Files in `web/deploy/`: `install.sh` (one-shot setup), `update.sh`, a systemd
+unit, and an env template.
+
+**Where to clone:** anywhere — `install.sh` points the service at wherever it
+finds itself. `/opt/ponfw` is recommended: it's the FHS spot for this kind of
+software, and the hardened unit sets `ProtectHome=true`, which would block the
+service from reading a checkout under `/home`.
 
 ```bash
 # --- as root on the LXC, once ---
-apt update && apt install -y nodejs npm git      # Node 18+; or use NodeSource
-adduser --system --group --no-create-home ponfw
-
 git clone ssh://forgejo@int.git.vanvikinternet.no/Svorka/ponfw.git /opt/ponfw
-cd /opt/ponfw
-npm install --omit=dev --no-audit --no-fund      # installs tough-cookie, skips Electron
-
-install -m 0644 web/deploy/pon-fleet-web.service /etc/systemd/system/
-install -m 0640 web/deploy/pon-fleet-web.env.example /etc/pon-fleet-web.env
-$EDITOR /etc/pon-fleet-web.env                    # set HOST / PFW_SECURE_COOKIE etc.
-
-systemctl daemon-reload
-systemctl enable --now pon-fleet-web
-systemctl status pon-fleet-web
-journalctl -u pon-fleet-web -f                    # logs
+sudo /opt/ponfw/web/deploy/install.sh
+$EDITOR /etc/pon-fleet-web.env       # optional: HOST / PFW_SECURE_COOKIE / TTL
+sudo systemctl restart pon-fleet-web # if you edited the env
 ```
 
-The repo lives at `/opt/ponfw` (root-owned, read-only to the service); the
-service runs as the unprivileged `ponfw` user and writes nothing to disk.
+`install.sh` is idempotent and:
 
-**To update:** just re-pull and restart —
+- installs `git` / `nodejs` / `npm` if missing (and checks Node ≥ 18),
+- creates the unprivileged `ponfw` system user,
+- runs `npm install --omit=dev` (tough-cookie only; skips Electron),
+- writes `/etc/pon-fleet-web.env` from the template on first run,
+- installs the systemd unit with `WorkingDirectory` set to this checkout,
+  then enables + starts it,
+- prints the LXC IP and the NPM forward target.
+
+The checkout is root-owned and read-only to the service; the service runs as
+`ponfw` and writes nothing to disk.
 
 ```bash
-sudo /opt/ponfw/web/deploy/update.sh             # git pull + npm install + restart
+journalctl -u pon-fleet-web -f          # logs
+sudo /opt/ponfw/web/deploy/update.sh    # update: git pull + npm install + restart
 ```
 
 ## Behind Nginx Proxy Manager