move host setup into scripts/setup/

scripts/ was holding two unrelated kinds of thing: install-this-machine, and run-this-occasionally. The
eight installers now live in scripts/setup/; what stays at the top level is the build steps (gen-index,
prebuild, build/) and the two maintenance scripts (reindex-music, rebuild-soulseek-tree).

The move is not just a rename. Three of these derive the repo root from their own location:

  setup.sh:51            PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
  setup_mac_light.sh:51  same
  cleanup-desktop.sh:134 ENV_FILE="$(dirname "$0")/../.env"

Left alone, all three would now resolve to scripts/ — and nothing downstream complains. PROJECT_DIR is
where .env is written, where `bun install`, `gen:index` and `db:push` run, and what pm2 is pointed at, so
a fresh install would have quietly provisioned scripts/ and reported success. cleanup-desktop.sh fails
the other way: it would find no .env, print "No .env — skipping", and leave the real VNC_PASSWORD in the
real file. All three are now `../..` with a comment saying why the level matters.

provision-user-dirs.ts imports data-path.ts relatively; that one tsgo caught.

Also disambiguated `setup.sh` where it had become two files. app-store/templates/<name>/setup.sh is a
per-sidecar installer with its own contract, and preflight.ts + docs/sidecar-app-store.md discussed both
in the same paragraph. The host one is now spelled with its full path at those sites.

Verified: bash -n on all six shell scripts, tsgo clean, os-user tests pass, both derivations resolve to
the repo root, starship.toml still resolves from os-user-shell.ts, and provision-user-dirs.ts runs under
DRY_RUN.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/per-user-linux-accounts.md

@@ -146,7 +146,7 @@ test (`os-user.test.ts` → "does not pass the platform environment through").
 sudoers *policy* — `env_reset`, `env_keep`, `always_set_home` — and "which variables cross into a member's
 shell" must not depend on a config file someone may have edited.
 
-Root is available: `scripts/setup.sh` §4 installs `/etc/sudoers.d/officer-service` granting the service
+Root is available: `scripts/setup/setup.sh` §4 installs `/etc/sudoers.d/officer-service` granting the service
 user `NOPASSWD: ALL` on the full profile. The light profile deliberately skips it, so a light install that
 wants OS users needs a **narrow** entry — `useradd`, `chown`, `setpriv` — which is better than the blanket
 rule anyway.

docs/sidecar-app-store.md

@@ -107,9 +107,13 @@ consequences, both wanted:
 
 ### Docker is assumed, and nothing guarantees it
 
-Verified: **nothing in `scripts/` installs Docker, and nothing checks for it.** `setup.sh` calls
-`setup-dockers.sh`, which invokes `docker compose` with no preflight, so a fresh host without Docker
-fails partway through setup with a bare "command not found".
+Verified: **nothing in `scripts/` installs Docker, and nothing checks for it.** The host installer
+`scripts/setup/setup.sh` calls `scripts/setup/setup-dockers.sh`, which invokes `docker compose` with no
+preflight, so a fresh host without Docker fails partway through setup with a bare "command not found".
+
+(Not to be confused with the per-template `setup.sh` below — `app-store/templates/<name>/setup.sh` — which
+is a different file with a different contract. The host one provisions the machine; a template one
+provisions a single sidecar.)
 
 That is the seam where this project's origin shows — it began as one person's own machine, provisioned
 by his own scripts, where Docker was simply always there.