feat(deploy): add install script and untrack share.config

Package the service for setup on a new machine:

- install.sh generates a token, writes share.config (mode 600, token
  stored as a SHA-256 hash) and installs the systemd user unit from
  share.service.template
- share.config is now gitignored, with share.config.example as the
  tracked template — the config holds the secret and must not be in
  the repo
- warn at startup when token is empty, since that means open access
- SETUP.md documents install, verification and security posture

share.config.example

@@ -0,0 +1,49 @@
+; Copy to share.config and edit. share.config is gitignored — it holds the secret.
+;   cp share.config.example share.config
+; Or let install.sh do it for you.
+
+[server]
+; Port to listen on (all interfaces, 0.0.0.0)
+port = 3001
+
+; Upload directory — created at startup if missing
+dir = ~/Downloads/shared
+
+; File lifetime in days (0 = keep forever)
+ttl = 7
+
+; Extra IPs to put in the TLS cert SAN, space-separated.
+; 127.0.0.1 and the detected LAN IP are always included.
+; Add the router IP here if you reach the box through it, e.g. 192.168.0.1
+san =
+
+; UI language: ru | en
+lang = ru
+
+; File list auto-refresh interval, seconds
+refresh = 5
+
+; Auth token. REQUIRED — an empty value means open access to anyone on the LAN.
+; Store the SHA-256 hash, not the plaintext:
+;     python3 share.py hash mysecret
+; A 64-char hex value is treated as a hash; anything else is hashed at startup.
+token =
+
+; Page-size options offered in the UI
+per_page = 10,25,50,100
+
+; Explicit TLS cert/key. Leave empty to auto-generate a self-signed pair in .certs/
+cert =
+key =
+
+; Values below are implementation constants — no need to touch them.
+[internal]
+secs_per_day = 86400
+cleanup_interval = 3600
+ssl_handshake_timeout = 5
+sniff_size = 8192
+chunk_size = 65536
+cert_days = 3650
+cert_key_bits = 2048
+toast_ms = 2500
+progress_hide_ms = 1200