Linux x86_64 offline release; configurable API and bundled PostgreSQL ports.

- packaging/linux: netx-<ver>-linux-x86_64.tar.gz with bundled Python 3.12,
  PostgreSQL 16 and web/dist (glibc >= 2.17). install.sh (install/update/
  reinstall), netxctl (start/stop/status/logs, set-port, set-bind,
  set-pg-port, reconfigure-db, check-update/update/auto-update, backup,
  uninstall), systemd units, nohup fallback without systemd. Privilege
  drop, detaching and tar go through the bundled Python, so bare images
  without su/runuser/setsid/tar work.
- Updates: same GitHub/Forgejo/manifest sources as Windows, sha256
  verified, pre-update pg_dump, automatic rollback when the new version
  does not come up.
- Non-loopback bind: generated bootstrap admin password and
  NETX_UME_VERIFY_TLS=true, as security_bootstrap requires.
- Build in manylinux2014 + check_bundle.sh (GLIBC <= 2.17, no missing
  libs); release-linux.yml builds on v* tags and smoke-tests offline on
  CentOS 7, Rocky 9, Ubuntu 18.04/24.04, Debian 12, openSUSE Leap 15 and
  openEuler 22.03 before attaching to the release.
- Windows: Setup DB page gets a bundled PG port field and
  /BundledPgPort=; set_pg_port.ps1 + tray "Built-in database port";
  reconfigure keeps the configured port; postgresql.conf is written
  without a BOM (PS 5.1 Set-Content -Encoding utf8 broke postgres).
- Forgejo/GitHub publish scripts include the Linux package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/setup_first_run.ps1

@@ -113,6 +113,21 @@ if ($DbMode -eq "bundled") {
             }
         }
     }
+    # Keep the configured port on reconfigure unless the caller passes -BundledPort.
+    if (-not $PSBoundParameters.ContainsKey("BundledPort")) {
+        $keepPort = 0
+        if ($existing.ContainsKey("NETX_BUNDLED_PG_PORT")) {
+            try { $keepPort = [int]$existing["NETX_BUNDLED_PG_PORT"] } catch { $keepPort = 0 }
+        }
+        if ($keepPort -ge 1024 -and $keepPort -le 65535) { $BundledPort = $keepPort }
+        if (-not $NonInteractive) {
+            $entered = (Read-Host (T "Bundled PostgreSQL port [$BundledPort]" "内置 PostgreSQL 端口 [$BundledPort]")).Trim()
+            if ($entered) { $BundledPort = [int]$entered }
+        }
+    }
+    if ($BundledPort -lt 1024 -or $BundledPort -gt 65535) {
+        throw "invalid_bundled_port: $BundledPort (1024-65535)"
+    }
     $pgData = Join-Path $data "pgdata"
     $values["NETX_BUNDLED_PG_PORT"] = "$BundledPort"
     $values["NETX_BUNDLED_PG_DATA_DIR"] = (ConvertTo-NetxFsPath $pgData)
@@ -147,7 +162,9 @@ if ($DbMode -eq "bundled") {
             } else {
                 $confText = $confText -replace "(?m)^\s*listen_addresses\s*=\s*'[^']*'", "listen_addresses = '127.0.0.1'"
             }
-            Set-Content -Path $conf -Value $confText -Encoding utf8
+            # No BOM: PowerShell 5.1 `Set-Content -Encoding utf8` adds one and postgres then
+            # rejects postgresql.conf (syntax error at line 1) and will not start.
+            [IO.File]::WriteAllText($conf, $confText, (New-Object System.Text.UTF8Encoding($false)))
         }
     }
     if (Test-Path $hba) {