Package the service for setup on a new machine:
- install.sh generates a token, writes share.config (mode 600, token
stored as a SHA-256 hash) and installs the systemd user unit from
share.service.template
- share.config is now gitignored, with share.config.example as the
tracked template — the config holds the secret and must not be in
the repo
- warn at startup when token is empty, since that means open access
- SETUP.md documents install, verification and security posture
eberkheev
