Linux x86_64 offline release; configurable API and bundled PostgreSQL ports.

- packaging/linux: netx-<ver>-linux-x86_64.tar.gz with bundled Python 3.12,
  PostgreSQL 16 and web/dist (glibc >= 2.17). install.sh (install/update/
  reinstall), netxctl (start/stop/status/logs, set-port, set-bind,
  set-pg-port, reconfigure-db, check-update/update/auto-update, backup,
  uninstall), systemd units, nohup fallback without systemd. Privilege
  drop, detaching and tar go through the bundled Python, so bare images
  without su/runuser/setsid/tar work.
- Updates: same GitHub/Forgejo/manifest sources as Windows, sha256
  verified, pre-update pg_dump, automatic rollback when the new version
  does not come up.
- Non-loopback bind: generated bootstrap admin password and
  NETX_UME_VERIFY_TLS=true, as security_bootstrap requires.
- Build in manylinux2014 + check_bundle.sh (GLIBC <= 2.17, no missing
  libs); release-linux.yml builds on v* tags and smoke-tests offline on
  CentOS 7, Rocky 9, Ubuntu 18.04/24.04, Debian 12, openSUSE Leap 15 and
  openEuler 22.03 before attaching to the release.
- Windows: Setup DB page gets a bundled PG port field and
  /BundledPgPort=; set_pg_port.ps1 + tray "Built-in database port";
  reconfigure keeps the configured port; postgresql.conf is written
  without a BOM (PS 5.1 Set-Content -Encoding utf8 broke postgres).
- Forgejo/GitHub publish scripts include the Linux package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/publish_forgejo_release.ps1

@@ -7,7 +7,7 @@
     [string]$ReleaseDir = ""
 )
 
-# Publish Windows Setup.exe to Forgejo/Gitea (mirror sync does NOT copy GitHub Release files).
+# Publish Windows Setup.exe (+ the Linux tar.gz when present in the release dir) to Forgejo/Gitea (mirror sync does NOT copy GitHub Release files).
 # Requires a Forgejo token with repo write (Settings → Applications → Generate New Token).
 # Default: https://git.avelo.top (public domain). LAN IP only when explicitly reachable.
 #
@@ -29,6 +29,9 @@ $tag = "v$Version"
 $relDir = if ($ReleaseDir) { $ReleaseDir } else { Join-Path $PSScriptRoot "release" }
 $setup = Join-Path $relDir "NetX-Setup-$Version.exe"
 $checksum = "$setup.sha256"
+# Linux package from CI (gh release download vX -p 'netx-*-linux-*' -D packaging\release) or a local build.
+$linuxPkg = Join-Path $relDir "netx-$Version-linux-x86_64.tar.gz"
+$linuxSum = "$linuxPkg.sha256"
 
 if (-not $Token) {
     $Token = $env:NETX_FORGEJO_TOKEN
@@ -84,10 +87,15 @@ try {
 }
 
 $notes = @"
-NetX $Version Windows installer (published from GitHub release build).
+NetX $Version (published from GitHub release build).
 
-- NetX-Setup-$Version.exe
+- NetX-Setup-$Version.exe — Windows installer
 "@
+if (Test-Path $linuxPkg) {
+    $notes += "`n- netx-$Version-linux-x86_64.tar.gz — Linux x86_64 offline package (``sudo ./install.sh``)"
+} else {
+    Write-Host "[WARN] Linux package not found ($linuxPkg); publishing Windows only" -ForegroundColor Yellow
+}
 
 if ($existing -and $existing.id) {
     Write-Host "==> Release $tag already exists (id=$($existing.id)); deleting old release to re-upload assets"
@@ -127,6 +135,14 @@ function Upload-ForgejoAsset {
 
 Upload-ForgejoAsset -Path $setup
 Upload-ForgejoAsset -Path $checksum
+if (Test-Path $linuxPkg) {
+    if (-not (Test-Path $linuxSum)) {
+        $lh = (Get-FileHash -LiteralPath $linuxPkg -Algorithm SHA256).Hash.ToLowerInvariant()
+        Set-Content -LiteralPath $linuxSum -Value "$lh  $(Split-Path -Leaf $linuxPkg)" -Encoding ascii -NoNewline
+    }
+    Upload-ForgejoAsset -Path $linuxPkg
+    Upload-ForgejoAsset -Path $linuxSum
+}
 
 $releaseUrl = "$ForgejoBase/$Owner/$Repo/releases/tag/$tag"
 Write-Host ""