Rebuild gaps closed: Authentik bootstrap creds, Gitea install lock + admin user from .env, Syncthing GUI-auth-off fixup, plugin ensured on apply, portal built by install.sh; README rebuild section with the honest manual remainder

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

install.sh

@@ -67,6 +67,12 @@ echo "== compose images (the stack is started by ./configure.py --full, which ge
 chown -R "$OWNER:" .
 docker compose pull -q --ignore-buildable 2>/dev/null || docker compose pull -q || true
 
+echo "== live portal: build into /srv/live (node)"
+if [[ -d live && -f live/package.json ]]; then
+  ( cd live && sudo -u "$OWNER" -H npm install --no-audit --no-fund --loglevel=error && sudo -u "$OWNER" -H npm run build ) \
+    && install -d -o "$OWNER" /srv/live && rsync -a --delete live/dist/ /srv/live/ && echo "   built" || echo "   portal build failed (run ./deployLive.sh from a dev box later)"
+fi
+
 echo "== host firewall (nftables; own table, input only; keeps this SSH session alive)"
 if [[ -f firewall/firewall.sh ]]; then
   bash firewall/firewall.sh