docs: OSS readiness — README hero, one-line installer, stale doc fixes

Restructure README to the standard OSS layout (logo, badges, screenshots
grid, architecture, quick start). Add install.sh for curl|sh installs with
a named-volume fallback for Docker Desktop file-sharing limits, and
scripts/setup.sh for clone-based setup. Correct SECURITY.md (no longer
pre-1.0) and CONTRIBUTING.md (auth shipped in 2.0.0).

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

install.sh

@@ -0,0 +1,80 @@
+#!/bin/sh
+# Dash installer — curl -fsSL https://raw.githubusercontent.com/Dvorinka/Dash/main/install.sh | sh
+# Creates ./dash, writes a compose file, pulls the image, starts on :3000.
+set -eu
+
+DIR="${DASH_DIR:-dash}"
+PORT="${DASH_PORT:-3000}"
+IMAGE="ghcr.io/dvorinka/dash:latest"
+DATA_HINT=""
+
+info() { printf '  %s\n' "$1"; }
+fail() { printf 'error: %s\n' "$1" >&2; exit 1; }
+
+command -v docker >/dev/null 2>&1 || fail "docker not found — install Docker first: https://docs.docker.com/engine/install"
+docker info >/dev/null 2>&1 || fail "docker daemon not reachable — start it, or run with sudo/root"
+
+mkdir -p "$DIR/data"
+cd "$DIR"
+
+# compose.yml with a bind mount (data dir visible next to the file) or, when
+# Docker Desktop file sharing forbids it, a named volume.
+write_compose() {
+    if [ "$1" = "named" ]; then
+        cat > compose.yml <<EOF
+# Generated by Dash install.sh - safe to edit.
+services:
+  dash:
+    image: $IMAGE
+    ports:
+      - "$PORT:3000"
+    volumes:
+      - dash-data:/data
+    restart: unless-stopped
+
+volumes:
+  dash-data:
+EOF
+    else
+        cat > compose.yml <<EOF
+# Generated by Dash install.sh - safe to edit.
+services:
+  dash:
+    image: $IMAGE
+    ports:
+      - "$PORT:3000"
+    volumes:
+      - ./data:/data
+    restart: unless-stopped
+EOF
+    fi
+}
+
+if docker compose version >/dev/null 2>&1; then
+    write_compose bind
+    docker compose pull
+    if up_out=$(docker compose up -d --remove-orphans 2>&1); then
+        DATA_HINT="$(pwd)/data"
+    elif printf '%s' "$up_out" | grep -qi "not shared\|mounts denied"; then
+        info "Host path not shareable - retrying with a named volume"
+        write_compose named
+        docker compose up -d --remove-orphans
+        DATA_HINT="the 'dash-data' docker volume (docker volume ls | grep dash-data)"
+    else
+        printf '%s\n' "$up_out" >&2
+        exit 1
+    fi
+else
+    # No compose plugin — named volume keeps docker run free of host-path rules.
+    info "Compose plugin absent; using docker run"
+    docker rm -f dash >/dev/null 2>&1 || true
+    docker pull "$IMAGE"
+    docker run -d --name dash --restart unless-stopped \
+        -p "$PORT:3000" -v dash-data:/data "$IMAGE"
+    DATA_HINT="docker volume 'dash-data'"
+fi
+
+info ""
+info "Dash is up: http://localhost:$PORT"
+info "Data lives in $DATA_HINT — back it up to back up everything."
+info "Upgrade later: docker compose pull && docker compose up -d   (or: docker pull $IMAGE && docker restart dash)"