One-command installer for CaveCMS. Downloads the latest signed release, generates secrets, prompts for the minimum (DB + URL), writes a sealed env.production, runs migrations, and starts the service. Customers never touch env files by hand.