ci: build images on every change, add install script

- docker job: buildx + GHA cache, GHCR push on main/tags via
  metadata-action tags, Trivy scan (report-only)
- fix: tag pushes now trigger the workflow so releases publish images
- root compose: parameterized host ports, backend healthcheck,
  frontend waits for healthy backend
- install.sh: generates .env secrets, builds, boots, waits for health
- README: easy-install section, port remap docs, CI badge

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

install.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Containr one-shot installer: creates .env with generated secrets, builds
+# images, boots the stack, and waits for the API to report healthy.
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+info() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
+err()  { printf '\033[1;31mError:\033[0m %s\n' "$*" >&2; }
+
+# Dependencies
+command -v docker >/dev/null 2>&1 || { err "docker not found. Install Docker: https://docs.docker.com/get-docker/"; exit 1; }
+docker compose version >/dev/null 2>&1 || { err "docker compose (v2) not found. Update Docker or install the compose plugin."; exit 1; }
+docker info >/dev/null 2>&1 || { err "docker daemon is not running or not reachable."; exit 1; }
+command -v openssl >/dev/null 2>&1 || { err "openssl not found (needed to generate secrets)."; exit 1; }
+command -v curl >/dev/null 2>&1 || { err "curl not found (needed for the health check)."; exit 1; }
+
+# Env file
+if [[ -f .env ]]; then
+    info "Existing .env found - keeping it."
+else
+    info "Creating .env from .env.example with generated secrets..."
+    cp .env.example .env
+
+    gen() { openssl rand -hex 32; }
+    setvar() { # setvar KEY VALUE  (| is safe: generated values are hex)
+        sed -i.bak "s|^$1=.*|$1=$2|" .env
+    }
+
+    PG_PASS="$(gen)"; REDIS_PASS="$(gen)"
+    setvar JWT_SECRET "$(gen)"
+    setvar BETTER_AUTH_SECRET "$(gen)"
+    setvar BETTER_AUTH_INTERNAL_TOKEN "$(gen)"
+    setvar CONTAINR_AGENT_AUTH_TOKEN "$(gen)"
+
+    # Password placeholders appear in several keys; replace them all so
+    # POSTGRES_PASSWORD, DATABASE_URL and DB_PASSWORD stay in sync.
+    sed -i.bak "s|your_secure_postgres_password|$PG_PASS|g" .env
+    sed -i.bak "s|your_secure_redis_password|$REDIS_PASS|g" .env
+    rm -f .env.bak
+    info ".env created with random secrets."
+fi
+
+# Ports (overridable via environment, matching docker-compose.yml vars)
+HTTP_PORT="${HTTP_PORT:-3000}"
+API_PORT="${API_PORT:-8082}"
+
+# Build and boot
+info "Building images and starting the stack..."
+docker compose up -d --build
+
+# Wait for the API
+info "Waiting for the API on http://localhost:${API_PORT}/health ..."
+healthy=""
+for _ in $(seq 1 90); do
+    if curl -sf "http://localhost:${API_PORT}/health" >/dev/null 2>&1; then
+        healthy=1
+        break
+    fi
+    sleep 2
+done
+
+if [[ -z "$healthy" ]]; then
+    err "API did not become healthy. Inspect with: docker compose logs backend"
+    exit 1
+fi
+
+info "Containr is running."
+echo "  UI:  http://localhost:${HTTP_PORT}"
+echo "  API: http://localhost:${API_PORT}"
+echo ""
+echo "Manage with: docker compose logs -f | docker compose down"