feat(deploy): add install script and untrack share.config

Package the service for setup on a new machine:

- install.sh generates a token, writes share.config (mode 600, token
  stored as a SHA-256 hash) and installs the systemd user unit from
  share.service.template
- share.config is now gitignored, with share.config.example as the
  tracked template — the config holds the secret and must not be in
  the repo
- warn at startup when token is empty, since that means open access
- SETUP.md documents install, verification and security posture

.gitignore

@@ -1,3 +1,5 @@
 .certs/
 __pycache__/
 *.pyc
+share.config
+share-deploy*.zip