feat(ops): self-update script, systemd units, README install guide, recovery runbook

- deploy/ops-dashboard-updater/update.sh: git pull → docker build → force-recreate → smoke-test
- deploy/ops-dashboard-updater/install.sh: installs script + systemd units to host
- ops-dashboard-updater.service / .timer: oneshot + daily 03:00 scheduled trigger
- README.md: Installation and Configuration sections (env files, ops-agent, updater)
- docs/runbooks/recovery.md: agent-crash, DB corruption/restore, container failure, cert expiry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/ops-dashboard-updater/install.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Install the ops-dashboard self-update script and systemd units.
+# Run as root from within the repo.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+INSTALL_DIR=/opt/ops-dashboard-updater
+SERVICE_DIR=/etc/systemd/system
+
+echo "==> Installing update script to ${INSTALL_DIR}"
+mkdir -p "${INSTALL_DIR}"
+install -m 0750 -o root -g root \
+  "${REPO_DIR}/deploy/ops-dashboard-updater/update.sh" \
+  "${INSTALL_DIR}/update.sh"
+
+echo "==> Installing systemd units"
+install -m 0644 -o root -g root \
+  "${REPO_DIR}/deploy/ops-dashboard-updater/ops-dashboard-updater.service" \
+  "${SERVICE_DIR}/ops-dashboard-updater.service"
+install -m 0644 -o root -g root \
+  "${REPO_DIR}/deploy/ops-dashboard-updater/ops-dashboard-updater.timer" \
+  "${SERVICE_DIR}/ops-dashboard-updater.timer"
+
+systemctl daemon-reload
+
+echo ""
+echo "==> Done. To enable automatic scheduled updates:"
+echo "    systemctl enable --now ops-dashboard-updater.timer"
+echo ""
+echo "    To run a manual update now:"
+echo "    systemctl start ops-dashboard-updater.service"
+echo "    # or directly:"
+echo "    /opt/ops-dashboard-updater/update.sh"