fix: resolve 13 release-consistency findings

Documentation:
- Fix CI badge href to /actions (was 404 on Gitea)
- Add UPTOP_METRICS_PUBLIC + UPTOP_MAINT_RETENTION to README env table
- Link maintenance retention to env var name in data retention section
- Note metrics auth requirement in features list
- Fix clustering.md: fail-closed wording, mark AGG_STRATEGY/NODE_REGION optional
- Fix .env.example: wording (no .env loader), add TRUSTED_PROXIES + MAINT_RETENTION
- Add CLI help/usage with subcommand listing, accept serve/help/-h/-version

Docker/deploy:
- Add EXPOSE 8080 to Dockerfile
- Remove dead LIPGLOSS_RENDERER_HAS_DARK_BACKGROUND env
- Exempt /api/health from cluster auth (fixes Docker HEALTHCHECK 401)
- Add sysctls for unprivileged ping to all compose files

Cosmetic:
- Fix bug_report.yaml: SemVer placeholder, remove nonexistent serve subcommand

.gitea/issue_template/bug_report.yaml

@@ -16,7 +16,7 @@ body:
       label: What happened?
       description: Include what you expected to happen instead.
       placeholder: |
-        When I run `uptop serve`, the TUI crashes after 10 seconds.
+        When I run `uptop`, the TUI crashes after 10 seconds.
         I expected it to keep running and display monitor status.
     validations:
       required: true
@@ -25,7 +25,7 @@ body:
     attributes:
       label: Steps to reproduce
       placeholder: |
-        1. Run `uptop serve`
+        1. Run `uptop`
         2. Wait ~10 seconds
         3. TUI crashes with panic
     validations:
@@ -37,7 +37,7 @@ body:
       description: Output of `uptop version`, OS, terminal. Paste any errors below.
       render: shell
       placeholder: |
-        uptop version 2026.06.1
+        uptop 0.1.0 (abc1234, 2026-06-17)
         OS: Debian 13
         Terminal: Ghostty