feat(deploy): add install script and untrack share.config

Package the service for setup on a new machine:

- install.sh generates a token, writes share.config (mode 600, token
  stored as a SHA-256 hash) and installs the systemd user unit from
  share.service.template
- share.config is now gitignored, with share.config.example as the
  tracked template — the config holds the secret and must not be in
  the repo
- warn at startup when token is empty, since that means open access
- SETUP.md documents install, verification and security posture

README.md

@@ -4,23 +4,35 @@ Local network file sharing via web page. Drag & drop, Ctrl+V paste, download.
 
 No dependencies — Python 3 stdlib only.
 
+Setting this up on a new machine? See [SETUP.md](SETUP.md).
+
 ## Quick start
 
 ```
+./install.sh          # generates a token, installs + starts the systemd service
+```
+
+Or run it in the foreground without installing anything:
+
+```
+cp share.config.example share.config    # then set `token` in it
 python3 share.py
 ```
 
-Open `http://localhost:8888` in a browser. The network address is printed at startup.
+Open `https://localhost:3001` in a browser. The network address is printed at
+startup. The cert is self-signed, so expect a browser warning on first visit.
 
 ## Options
 
+CLI flags override `share.config`.
+
 ```
 python3 share.py -p 3001 -d ~/Downloads/shared --ttl 7
 ```
 
 | Flag | Default | Description |
 |------|---------|-------------|
-| `-p`, `--port` | `8888` | Port |
+| `-p`, `--port` | `3001` | Port |
 | `-d`, `--dir` | `~/Downloads/shared` | Upload directory |
 | `--ttl` | `7` | File lifetime in days (0 = keep forever) |
 | `--token` | | Auth token (empty = open access) |
@@ -29,7 +41,11 @@ python3 share.py -p 3001 -d ~/Downloads/shared --ttl 7
 
 ## Authentication
 
-Set `token` in `share.config` or pass `--token`. All endpoints require a valid token.
+Set `token` in `share.config` or pass `--token`. All endpoints require a valid
+token. An empty `token` means open access to everyone on the network.
+
+`share.config` is gitignored because it holds the secret — `share.config.example`
+is the tracked template.
 
 The token can be stored as plain text or as a SHA-256 hash:
 
@@ -45,7 +61,9 @@ If the value is a 64-character hex string, it is treated as a hash. Otherwise it
 
 ## systemd (Arch)
 
-Service file: `~/.config/systemd/user/share.service`
+Installed by `./install.sh` from `share.service.template` to
+`~/.config/systemd/user/share.service`. Restart after editing `share.config` —
+it is only read at startup.
 
 ```
 systemctl --user enable --now share    # start + autostart