feat: UmbrelOS-style CE with iStore, Casdoor auth, and App Manager

- iStore service (port 3021): fetches app manifests from git.falahos.my/falahos
  org via Gitea API, 5-min cache, query/search support
- UmmahID login: replaced stub form with Casdoor OAuth2 PKCE flow (RFC 7636),
  no client secret required; /api/auth/config and /api/auth/token endpoints
  added to server.cjs
- App Manager service (port 3022): installs/uninstalls Docker apps via
  /var/run/docker.sock, pulls images, starts containers on falah-net,
  persists state to /data/installed.json
- docker-compose.yml: orchestrates falah-app + istore + app-manager with
  health checks, named volumes, and shared falah-net network
- install.sh: one-line curl installer — checks prereqs, clones repo,
  prompts for credentials, builds and starts all containers
- .env.example: all env vars documented (CASDOOR_CLIENT_ID, GITEA_TOKEN,
  APP_MANAGER_PORT, etc.)
- Frontend: IStore overlay now fetches live apps from Gitea, real
  install/uninstall via App Manager with 2s polling, indeterminate
  progress bar, Uninstall button for installed apps
- app.yml.example: developer manifest spec for publishing to iStore

docker-compose.yml

@@ -0,0 +1,90 @@
+services:
+
+  # ── Falah OS CE — frontend + auth proxy ──────────────────────────────────
+  falah-app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: falah-app
+    restart: unless-stopped
+    ports:
+      - "${CE_PORT:-3005}:3000"
+    environment:
+      NODE_ENV: production
+      CASDOOR_ENDPOINT:  ${CASDOOR_ENDPOINT:-https://auth.falahos.my}
+      CASDOOR_CLIENT_ID: ${CASDOOR_CLIENT_ID}
+    depends_on:
+      istore:
+        condition: service_healthy
+    networks:
+      - falah-net
+    labels:
+      falah.service: "falah-app"
+      falah.version: "1.3.0"
+
+  # ── iStore — Gitea-backed app registry ───────────────────────────────────
+  istore:
+    build:
+      context: ./services/istore
+      dockerfile: Dockerfile
+    container_name: falah-istore
+    restart: unless-stopped
+    ports:
+      - "${ISTORE_PORT:-3021}:3021"
+    environment:
+      NODE_ENV:     production
+      PORT:         3021
+      GITEA_TOKEN:  ${GITEA_TOKEN:-}
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3021/health"]
+      interval: 30s
+      timeout:  5s
+      retries:  3
+      start_period: 10s
+    networks:
+      - falah-net
+    labels:
+      falah.service: "istore"
+      falah.version: "1.0.0"
+
+  # ── App Manager — install/uninstall Docker apps ──────────────────────────
+  app-manager:
+    build:
+      context: ./services/app-manager
+      dockerfile: Dockerfile
+    container_name: falah-app-manager
+    restart: unless-stopped
+    ports:
+      - "${APP_MANAGER_PORT:-3022}:3022"
+    environment:
+      NODE_ENV:       production
+      PORT:           3022
+      ISTORE_URL:     http://istore:3021
+      DOCKER_NETWORK: falah-net
+      DATA_DIR:       /data
+    volumes:
+      - app-manager-data:/data
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    depends_on:
+      istore:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3022/health"]
+      interval: 30s
+      timeout:  5s
+      retries:  3
+      start_period: 10s
+    networks:
+      - falah-net
+    labels:
+      falah.service: "app-manager"
+      falah.version: "1.0.0"
+
+volumes:
+  app-manager-data:
+    name: falah-app-manager-data
+
+networks:
+  falah-net:
+    driver: bridge
+    name: falah-net