feat: install nodes and the backend from a static compose file; remove dead code [CI]

Agent, Probe and Backend now start from one static compose.yaml plus a local
.env: the panel (or the release assets, for the very first Backend) provides
the file, the panel's command writes the public values into .env, checks the
file's SHA-256 and runs compose up. Updating is compose pull && compose up -d.
The image is chosen by the CI channel (:latest, or MOSHIRO_VERSION in .env),
not by the panel; the previous one-line script stays as a fallback.

- packaging/compose/{agent,probe,backend}/compose.yaml are the single source,
  embedded in the Backend and served at /install/compose/{file}; the root
  compose.yaml moved there. Releases also carry them and list them in the
  signed SHA256SUMS.
- The container entrypoint defaults the node name to the host name.
- Join token creation returns a compose block (.env, url, hash, per-platform
  commands); the admin dialog leads with it.
- Remove code with no references (HotLayer members, LiveHub.SubscriberCount,
  QueryService.ParseParams, ReleaseService.Forget, a few constants) and reduce
  the install-code lookup to the role it is for.

ci/publish-gitea-release.sh

@@ -29,7 +29,7 @@ trap 'rm -rf "$tmp"' EXIT
 root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 install_sh="$(sha256sum "$root_dir/packaging/install/install.sh" | cut -d" " -f1)"
 install_ps1="$(sha256sum "$root_dir/packaging/install/install.ps1" | cut -d" " -f1)"
-release_body="Install script SHA-256 (compare with the panel before you run an install command): install.sh $install_sh, install.ps1 $install_ps1. Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux glibc Agent and Probe OCI images: registry.oeo.one/moshiro/moshiro-agent:$version and registry.oeo.one/moshiro/moshiro-probe:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/moshiro/moshiro-backend:$version (linux/amd64 and linux/arm64). macOS binaries are not Developer ID signed or notarized."
+release_body="Install script SHA-256 (compare with the panel before you run an install command): install.sh $install_sh, install.ps1 $install_ps1. Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux glibc Agent and Probe OCI images: registry.oeo.one/moshiro/moshiro-agent:$version and registry.oeo.one/moshiro/moshiro-probe:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/moshiro/moshiro-backend:$version (linux/amd64 and linux/arm64). Compose files for Agent, Probe and Backend: moshiro-compose-<role>.yaml (images use :latest, or pin MOSHIRO_VERSION in .env). macOS binaries are not Developer ID signed or notarized."
 payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MoShiro %s","body":"%s","draft":false,"prerelease":false}' \
   "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
 release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
@@ -129,6 +129,13 @@ upload_local_asset() {
   echo "attached $name"
 }
 
+# compose 文件（Agent、Probe、Backend 各一份，静态，镜像用 :latest 或 .env 里的 MOSHIRO_VERSION）：作为发布资产，
+# 第一次部署 Backend 时还没有面板，就从这里下载；它们也记进 SHA256SUMS（有签名密钥时一起签名）。
+for role in agent probe backend; do
+  cp "$root_dir/packaging/compose/$role/compose.yaml" "$tmp/moshiro-compose-$role.yaml"
+  upload_local_asset "moshiro-compose-$role.yaml" "$tmp/moshiro-compose-$role.yaml"
+done
+
 if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
   sums="$tmp/SHA256SUMS"
   : > "$sums"
@@ -138,6 +145,10 @@ if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
     cat "$tmp/$archive.sha256" >> "$sums"
   done
   [[ "$(wc -l < "$sums")" -eq "${#assets[@]}" ]] || { echo "SHA256SUMS does not have one line per archive" >&2; exit 1; }
+  for role in agent probe backend; do
+    printf '%s  %s
+' "$(sha256sum "$tmp/moshiro-compose-$role.yaml" | cut -d' ' -f1)" "moshiro-compose-$role.yaml" >> "$sums"
+  done
   signing_key="$(mktemp)"
   chmod 600 "$signing_key"
   printf '%s\n' "$RELEASE_SIGNING_KEY" > "$signing_key"