feat: self-contained Docker installer with web setup wizard

- settings.ts: persistent settings.json in data volume (survives restarts)
- /api/setup: POST to save API_BASE_URL, API_KEY, WEB_PASSWORD, WEBHOOK_SECRET
- /setup: web-based setup wizard for first-time configuration
- /api/health: JSON health check endpoint for Docker healthcheck
- api.ts: dynamic API_BASE_URL/API_KEY resolution from settings
- login route: fallback WEB_PASSWORD from settings.json
- middleware: /setup and /api/setup are public paths
- Dockerfile: HEALTHCHECK instruction
- docker-compose.yml: healthcheck + optional .env file
- .env.example: full documentation of all env vars
- install.sh: single-command VPS installer (clone, build, run)

.env.example

@@ -1,16 +1,18 @@
-# API del pipeline (VPS1)
-API_BASE_URL=http://127.0.0.1:8080/api/v1
+# --- worst-scan-web ---
+# Copy to .env and adjust.
+
+# Backend API
+API_BASE_URL=http://host.docker.internal:8080/api/v1
 API_KEY=
 
-# Auth de la web (vacío = sin auth en dev)
+# Web auth
 WEB_PASSWORD=
 
-# Webhook Secret para sincronización automática desde el pipeline
+# Webhook validation
 WEBHOOK_SECRET=
 
-# Puerto
-PORT=3000
+# DB path
+DB_PATH=/app/data/worst-scan.db
 
-# Persistencia (SQLite + covers en data/)
-DB_PATH=data/worst-scan.db
-COVERS_DIR=data/covers
+# Covers dir
+COVERS_DIR=/app/data/covers