feat: UmbrelOS-style CE with iStore, Casdoor auth, and App Manager

- iStore service (port 3021): fetches app manifests from git.falahos.my/falahos
  org via Gitea API, 5-min cache, query/search support
- UmmahID login: replaced stub form with Casdoor OAuth2 PKCE flow (RFC 7636),
  no client secret required; /api/auth/config and /api/auth/token endpoints
  added to server.cjs
- App Manager service (port 3022): installs/uninstalls Docker apps via
  /var/run/docker.sock, pulls images, starts containers on falah-net,
  persists state to /data/installed.json
- docker-compose.yml: orchestrates falah-app + istore + app-manager with
  health checks, named volumes, and shared falah-net network
- install.sh: one-line curl installer — checks prereqs, clones repo,
  prompts for credentials, builds and starts all containers
- .env.example: all env vars documented (CASDOOR_CLIENT_ID, GITEA_TOKEN,
  APP_MANAGER_PORT, etc.)
- Frontend: IStore overlay now fetches live apps from Gitea, real
  install/uninstall via App Manager with 2s polling, indeterminate
  progress bar, Uninstall button for installed apps
- app.yml.example: developer manifest spec for publishing to iStore

.env.example

@@ -0,0 +1,23 @@
+# ── Falah OS CE — Environment Variables ──────────────────────────────────────
+# Copy this file to .env and fill in your values.
+# Credentials are stored in bitwarden.falahos.my
+#
+# cp .env.example .env
+
+# ── Ports (change only if defaults conflict on your host) ─────────────────────
+CE_PORT=3005            # Falah OS CE frontend
+ISTORE_PORT=3021        # iStore service
+APP_MANAGER_PORT=3022   # App Manager (install/uninstall)
+
+# ── UmmahID / Casdoor ─────────────────────────────────────────────────────────
+# Casdoor application settings — create an app at auth.falahos.my
+# and set redirect URI to http://<your-server-ip>:3005
+CASDOOR_ENDPOINT=https://auth.falahos.my
+CASDOOR_CLIENT_ID=           # from Casdoor app settings (Client ID field)
+# Note: no CASDOOR_CLIENT_SECRET needed — CE uses PKCE (RFC 7636)
+
+# ── iStore / Gitea ────────────────────────────────────────────────────────────
+# Personal access token from git.falahos.my/-/user/settings/applications
+# Scopes required: read:org, read:repository
+# Leave empty to use public repos only (rate-limited)
+GITEA_TOKEN=