feat(deploy): add install script and untrack share.config

Package the service for setup on a new machine:

- install.sh generates a token, writes share.config (mode 600, token
  stored as a SHA-256 hash) and installs the systemd user unit from
  share.service.template
- share.config is now gitignored, with share.config.example as the
  tracked template — the config holds the secret and must not be in
  the repo
- warn at startup when token is empty, since that means open access
- SETUP.md documents install, verification and security posture

share.py

@@ -45,6 +45,9 @@ def main():
     ctx.load_cert_chain(cert, key)
 
     token = conf["token"]
+    if not token:
+        print("\n  WARNING: no token set — anyone on the network has full access.")
+        print("  Set `token` in share.config (see SETUP.md) or pass --token.")
     # If token looks like a SHA-256 hash, pass it as pre-hashed
     is_hash = len(token) == 64 and all(c in "0123456789abcdef" for c in token)
     server = ShareServer(("0.0.0.0", port), Handler, upload_dir=upload_dir, html=html, ssl_ctx=ctx, token=token, token_is_hash=is_hash)