feat(deploy): add install script and untrack share.config

Package the service for setup on a new machine:

- install.sh generates a token, writes share.config (mode 600, token
  stored as a SHA-256 hash) and installs the systemd user unit from
  share.service.template
- share.config is now gitignored, with share.config.example as the
  tracked template — the config holds the secret and must not be in
  the repo
- warn at startup when token is empty, since that means open access
- SETUP.md documents install, verification and security posture

share.service.template

@@ -0,0 +1,18 @@
+;; Template — install.sh substitutes __DIR__ and __PYTHON__ and installs the
+;; result to ~/.config/systemd/user/share.service. Do not install this file directly.
+[Unit]
+Description=Share — local file sharing
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+; Unbuffered — otherwise Python block-buffers stdout when it is not a tty and the
+; startup banner / warnings never reach journalctl.
+Environment=PYTHONUNBUFFERED=1
+ExecStart=__PYTHON__ __DIR__/share.py
+WorkingDirectory=__DIR__
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=default.target