Linux x86_64 offline release; configurable API and bundled PostgreSQL ports.

- packaging/linux: netx-<ver>-linux-x86_64.tar.gz with bundled Python 3.12,
  PostgreSQL 16 and web/dist (glibc >= 2.17). install.sh (install/update/
  reinstall), netxctl (start/stop/status/logs, set-port, set-bind,
  set-pg-port, reconfigure-db, check-update/update/auto-update, backup,
  uninstall), systemd units, nohup fallback without systemd. Privilege
  drop, detaching and tar go through the bundled Python, so bare images
  without su/runuser/setsid/tar work.
- Updates: same GitHub/Forgejo/manifest sources as Windows, sha256
  verified, pre-update pg_dump, automatic rollback when the new version
  does not come up.
- Non-loopback bind: generated bootstrap admin password and
  NETX_UME_VERIFY_TLS=true, as security_bootstrap requires.
- Build in manylinux2014 + check_bundle.sh (GLIBC <= 2.17, no missing
  libs); release-linux.yml builds on v* tags and smoke-tests offline on
  CentOS 7, Rocky 9, Ubuntu 18.04/24.04, Debian 12, openSUSE Leap 15 and
  openEuler 22.03 before attaching to the release.
- Windows: Setup DB page gets a bundled PG port field and
  /BundledPgPort=; set_pg_port.ps1 + tray "Built-in database port";
  reconfigure keeps the configured port; postgresql.conf is written
  without a BOM (PS 5.1 Set-Content -Encoding utf8 broke postgres).
- Forgejo/GitHub publish scripts include the Linux package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/linux/build_linux_release.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Build netx-<ver>-linux-x86_64.tar.gz (+ .sha256) into packaging/release/.
+#
+#   packaging/linux/build_linux_release.sh [--version X.Y.Z] [--web-dist DIR] [--skip-web-build]
+#
+# Needs docker (the build runs inside manylinux2014 so the result works on glibc >= 2.17).
+# Node 20+ is needed only when web/dist must be (re)built.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "${HERE}/../.." && pwd)"
+# shellcheck source=versions.env
+. "${HERE}/versions.env"
+
+VERSION=""
+WEB_DIST=""
+SKIP_WEB_BUILD=0
+OUT="${REPO}/packaging/release"
+CACHE="${REPO}/packaging/cache/linux"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --version) VERSION="$2"; shift 2 ;;
+    --web-dist) WEB_DIST="$2"; shift 2 ;;
+    --skip-web-build) SKIP_WEB_BUILD=1; shift ;;
+    --out) OUT="$2"; shift 2 ;;
+    --cache) CACHE="$2"; shift 2 ;;
+    -h|--help) sed -n '2,8p' "$0"; exit 0 ;;
+    *) echo "unknown option: $1" >&2; exit 2 ;;
+  esac
+done
+
+if [[ -z "${VERSION}" ]]; then
+  VERSION="$(sed -n 's/^[[:space:]]*version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "${REPO}/pyproject.toml" | head -n1)"
+fi
+[[ -n "${VERSION}" ]] || { echo "cannot read version from pyproject.toml" >&2; exit 1; }
+command -v docker >/dev/null || { echo "docker is required" >&2; exit 1; }
+
+if [[ -z "${WEB_DIST}" ]]; then
+  WEB_DIST="${REPO}/web/dist"
+  if [[ "${SKIP_WEB_BUILD}" != "1" ]]; then
+    echo "==> npm build (web/dist)"
+    (cd "${REPO}/web" && npm ci && npm run build:release)
+  fi
+fi
+[[ -f "${WEB_DIST}/index.html" ]] || { echo "web dist missing: ${WEB_DIST}/index.html" >&2; exit 1; }
+WEB_DIST="$(cd "${WEB_DIST}" && pwd)"
+
+mkdir -p "${OUT}" "${CACHE}"
+fetch() { # fetch url sha256
+  local f
+  f="${CACHE}/$(basename "$1")"
+  if [[ ! -f "${f}" ]] || ! echo "$2  ${f}" | sha256sum -c --status; then
+    echo "==> download $1"
+    curl -fSL --retry 3 -o "${f}.part" "$1"
+    mv "${f}.part" "${f}"
+  fi
+  echo "$2  ${f}" | sha256sum -c --status || { echo "sha256 mismatch: ${f}" >&2; exit 1; }
+}
+fetch "${PG_URL}" "${PG_SHA256}"
+fetch "${PY_URL}" "${PY_SHA256}"
+
+echo "==> build in ${BUILD_IMAGE} (version ${VERSION})"
+docker run --rm \
+  -v "${REPO}:/src:ro" \
+  -v "${WEB_DIST}:/webdist:ro" \
+  -v "${CACHE}:/cache" \
+  -v "${OUT}:/out" \
+  -e VERSION="${VERSION}" \
+  -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
+  -e PIP_INDEX_URL="${PIP_INDEX_URL:-}" \
+  -e HTTP_PROXY="${HTTP_PROXY:-}" -e HTTPS_PROXY="${HTTPS_PROXY:-}" -e NO_PROXY="${NO_PROXY:-}" \
+  -e http_proxy="${http_proxy:-}" -e https_proxy="${https_proxy:-}" -e no_proxy="${no_proxy:-}" \
+  "${BUILD_IMAGE}" bash /src/packaging/linux/build_in_container.sh
+
+echo "==> done:"
+ls -la "${OUT}/netx-${VERSION}-linux-x86_64.tar.gz" "${OUT}/netx-${VERSION}-linux-x86_64.tar.gz.sha256"