feat: UmbrelOS-style CE with iStore, Casdoor auth, and App Manager

- iStore service (port 3021): fetches app manifests from git.falahos.my/falahos
  org via Gitea API, 5-min cache, query/search support
- UmmahID login: replaced stub form with Casdoor OAuth2 PKCE flow (RFC 7636),
  no client secret required; /api/auth/config and /api/auth/token endpoints
  added to server.cjs
- App Manager service (port 3022): installs/uninstalls Docker apps via
  /var/run/docker.sock, pulls images, starts containers on falah-net,
  persists state to /data/installed.json
- docker-compose.yml: orchestrates falah-app + istore + app-manager with
  health checks, named volumes, and shared falah-net network
- install.sh: one-line curl installer — checks prereqs, clones repo,
  prompts for credentials, builds and starts all containers
- .env.example: all env vars documented (CASDOOR_CLIENT_ID, GITEA_TOKEN,
  APP_MANAGER_PORT, etc.)
- Frontend: IStore overlay now fetches live apps from Gitea, real
  install/uninstall via App Manager with 2s polling, indeterminate
  progress bar, Uninstall button for installed apps
- app.yml.example: developer manifest spec for publishing to iStore

install.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# ──────────────────────────────────────────────────────────────────────────────
+# Falah OS CE — One-line installer
+# Usage:
+#   curl -fsSL https://raw.githubusercontent.com/falahos/falah-os-ce/main/install.sh | bash
+# ──────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+REPO_URL="https://github.com/falahos/falah-os-ce.git"
+INSTALL_DIR="${FALAH_DIR:-$HOME/falah-os}"
+CE_PORT="${CE_PORT:-3005}"
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+log()  { echo -e "${GREEN}[falah]${NC} $*"; }
+warn() { echo -e "${YELLOW}[warn]${NC}  $*"; }
+die()  { echo -e "${RED}[error]${NC} $*" >&2; exit 1; }
+
+# ── Prerequisites ─────────────────────────────────────────────────────────────
+
+check_cmd() { command -v "$1" &>/dev/null || die "$1 is required but not installed. Please install it first."; }
+
+log "Checking prerequisites…"
+check_cmd docker
+check_cmd git
+
+# Docker Compose v2 (plugin) or v1 (standalone)
+if docker compose version &>/dev/null 2>&1; then
+  COMPOSE="docker compose"
+elif command -v docker-compose &>/dev/null; then
+  COMPOSE="docker-compose"
+else
+  die "Docker Compose not found. Install it from https://docs.docker.com/compose/install/"
+fi
+
+# Confirm Docker daemon is running
+docker info &>/dev/null || die "Docker daemon is not running. Start Docker and retry."
+
+# ── Clone or update ───────────────────────────────────────────────────────────
+
+if [[ -d "$INSTALL_DIR/.git" ]]; then
+  log "Updating existing installation at $INSTALL_DIR…"
+  git -C "$INSTALL_DIR" pull --ff-only
+else
+  log "Installing Falah OS CE to $INSTALL_DIR…"
+  git clone --depth 1 "$REPO_URL" "$INSTALL_DIR"
+fi
+
+cd "$INSTALL_DIR"
+
+# ── Environment setup ─────────────────────────────────────────────────────────
+
+if [[ ! -f .env ]]; then
+  cp .env.example .env
+  log "Created .env from template"
+
+  echo ""
+  warn "──────────────────────────────────────────────────"
+  warn "  Configure your .env before starting Falah OS"
+  warn "  credentials are in bitwarden.falahos.my"
+  warn "──────────────────────────────────────────────────"
+  echo ""
+
+  # Interactive prompts — only if running in a terminal
+  if [[ -t 0 ]]; then
+    read -rp "  CASDOOR_CLIENT_ID (from auth.falahos.my): " casdoor_id
+    if [[ -n "$casdoor_id" ]]; then
+      sed -i.bak "s|^CASDOOR_CLIENT_ID=.*|CASDOOR_CLIENT_ID=$casdoor_id|" .env && rm -f .env.bak
+    fi
+
+    read -rp "  GITEA_TOKEN (from git.falahos.my, optional — press Enter to skip): " gitea_token
+    if [[ -n "$gitea_token" ]]; then
+      sed -i.bak "s|^GITEA_TOKEN=.*|GITEA_TOKEN=$gitea_token|" .env && rm -f .env.bak
+    fi
+  else
+    warn "Non-interactive mode — edit $INSTALL_DIR/.env manually then run:"
+    warn "  cd $INSTALL_DIR && $COMPOSE up -d"
+    exit 0
+  fi
+fi
+
+# ── Build & start ─────────────────────────────────────────────────────────────
+
+log "Building containers (this takes a minute on first run)…"
+$COMPOSE build --parallel
+
+log "Starting Falah OS CE…"
+$COMPOSE up -d
+
+# ── Health check ──────────────────────────────────────────────────────────────
+
+log "Waiting for services to be ready…"
+for i in $(seq 1 20); do
+  if curl -sf "http://localhost:${CE_PORT}/health" &>/dev/null; then
+    break
+  fi
+  if [[ $i -eq 20 ]]; then
+    warn "Falah OS CE did not respond in time. Check logs with:"
+    warn "  cd $INSTALL_DIR && $COMPOSE logs -f"
+    exit 1
+  fi
+  sleep 3
+done
+
+# ── Detect server IP for display ──────────────────────────────────────────────
+
+SERVER_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo "localhost")
+
+echo ""
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${GREEN}  ☽  Falah OS CE is running!${NC}"
+echo ""
+echo -e "  Browser →  http://${SERVER_IP}:${CE_PORT}"
+echo ""
+echo -e "  Manage  →  cd ${INSTALL_DIR}"
+echo -e "             $COMPOSE logs -f     (live logs)"
+echo -e "             $COMPOSE down        (stop)"
+echo -e "             $COMPOSE pull && $COMPOSE up -d  (update)"
+echo ""
+echo -e "  Casdoor redirect URI to register:"
+echo -e "  http://${SERVER_IP}:${CE_PORT}"
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""