[webbpinner]

Summary

Adds install.sh, which installs sealog-server on a fresh server and runs it as a systemd service:

• Supported: AlmaLinux/Rocky/RHEL 9 and 10, Debian 12 and 13, Ubuntu 24.04 and 26.04 (x86_64 and aarch64; Debian aarch64 only with --mongo-url).
• Installs Node.js 24 (NodeSource) and MongoDB 8.0 (official repo), creates a sealog system user, and clones 2.x into /opt/sealog-server.
• Creates config/*.js from the .dist templates and writes .env (mode 600) with a generated SEALOG_SERVER_SECRET.
• Runs npm ci --omit=dev --ignore-scripts, installs the sealog-server systemd unit, and checks that the API responds.
• Safe to re-run: updates the checkout and dependencies, never overwrites existing config or .env.
• Options: --port, --ref, --install-dir, --files-dir, --mongo-url, --mode demo-vehicle|demo-vessel, --with-python, --open-firewall (firewalld/ufw), -y. See --help.

Also adds a "Quick install" section to INSTALL.md.

Distro quirks handled

• Debian 13 / Ubuntu 26.04: MongoDB publishes no server packages for these yet, so the script uses the bookworm/noble packages. Their libssl3/libcurl4 dependencies are satisfied by the t64 packages.
• Linux ≥ 6.19 (e.g. Ubuntu 26.04): the packaged mongod.service sets GLIBC_TUNABLES=glibc.pthread.rseq=0, which makes MongoDB 8.x refuse to start (SERVER-121912). Only when that error is detected, the script adds a drop-in that unsets it and restarts mongod (MongoDB then logs a tcmalloc performance warning).
• EL9: default Python is 3.9 but requirements.txt needs ≥ 3.10, so --with-python uses python3.12.
• x86_64 without AVX (common with default VM CPU models): fails early with a clear message, since MongoDB 8 requires AVX.

Test plan

• shellcheck clean
• Docker containers for all 7 targets (Ubuntu 24.04/26.04, Debian 12/13, AlmaLinux 9/10, Rocky 10): install with --with-python, start mongod and the server, log in as admin, import Python deps, and re-run the script cleanly
• systemd containers (AlmaLinux 9, Ubuntu 26.04): mongod plus the kernel workaround, service active and enabled, API and /documentation return 200, login works, firewalld/ufw port opened, re-run is clean
• Real VM / bare-metal install
• SELinux enforcing on EL

Note: the curl one-liner in INSTALL.md points at the 2.x branch, so it works once this is released.

🤖 Generated with Claude Code