feat: replace setup.sh + nginx.sh with huly-setup (Go + Bubble Tea)

[IamCoder18]

Context

The shell-based setup.sh and nginx.sh scripts accumulated duplicated, fragile bash: re-prompting on every run, hard-coded localhost assumptions, and only one deployment profile. There was no way to script the setup, no dry-run mode, and no way to keep the in-stack nginx host port bound to 127.0.0.1 (so users behind an external reverse proxy had to edit the file by hand).

A new huly-setup Go binary replaces both scripts. It is built on Bubble Tea for the interactive flow, ships an embedded compose.yml per profile + topology, and can be installed via a single bash one-liner that downloads a release artifact.

Implementation

• cmd/huly-setup/main.go: flag parser + dispatch. Adds --quick, --dry-run, --non-interactive, --only-render, --skip-pull, --skip-up, --rotate-secrets, --reset-volumes, plus profile/topology selectors and an alias flag set (--single-tenant, --multi-tenant, --behind-reverse-proxy, --expose-mode, --bind-mode). Routes between the Bubble Tea UI and the runner based on TTY + flags.
• internal/tui/: Bubble Tea model with 9 steps: Welcome -> Profile -> Topology -> Expose (only for reverse-proxy) -> Host -> Port -> TLS -> Volumes -> Summary -> Review -> Confirm -> Done. Every step supports esc to go back. Ctrl+C aborts immediately and the runner is never invoked. The Review step shows exactly which files will be written, which docker commands will run, and the profile impact, before the user confirms. Text is wrapped to terminal width via muesli/reflow.
• internal/compose/: two embedded compose templates (multi and single). The single template cherry-picks the memory + logging tuning from the in-progress single-tenant branch (per-service deploy.resources.limits.memory, x-logging-*, GOGC=200, smaller Elastic heap, Redpanda constrained, DISABLED_FEATURES=auto-translate,mailboxes,signup,passwords,recover, INIT_REPO_DIR=/no-init-scripts). In reverse-proxy mode the nginx: service is stripped and ExposeMode injects ports: bindings (127.0.0.1:8080:8080, 0.0.0.0:8080:8080, or none for docker-network-only).
• internal/nginx/: .huly.nginx for the in-container nginx, plus reverse-proxy.conf snippet whose upstream targets switch between 127.0.0.1:port, 0.0.0.0:port, and docker service hostnames depending on ExposeMode.
• internal/config/, internal/envconf/, internal/secrets/: typed config, env-file rendering, and 32-byte-hex secret generation/reuse/rotation. Existing huly_v7.conf is loaded on every run so re-running is non-destructive.
• internal/runner/: orchestrates render -> persist -> pull -> up, with dry-run awareness.
• internal/docker/: CLI invoker + DryRunInvoker that logs but does not execute (used by --dry-run and tests).
• scripts/install.sh: bash one-liner that detects OS/arch, hits the GitHub Releases API, downloads the matching tarball, drops the binary in ~/.local/bin/huly-setup, and execs it. HULY_SETUP_VERSION, HULY_SETUP_REPO, and INSTALL_DIR overrides.
• .github/workflows/release.yaml: cross-compiles linux/darwin x amd64/arm64 + windows/amd64, packages tarballs (and zips for windows), uploads as release artifacts, and creates a draft GitHub release on huly-setup-v* tags.
• setup.sh: thin shim that prefers ./huly-setup, then huly-setup on $PATH, then go run ./cmd/huly-setup. All existing ./setup.sh --quick workflows keep working.
• nginx.sh deleted; the in-container nginx config is now managed by huly-setup.

README.md and the install references are updated to point at ./huly-setup and the new install script. cmd/huly-setup/README.md documents all flags, profiles, topologies, and the distribution story.

[IamCoder18]

Open to any changes!