fix: resolve 13 release-consistency findings

Documentation:
- Fix CI badge href to /actions (was 404 on Gitea)
- Add UPTOP_METRICS_PUBLIC + UPTOP_MAINT_RETENTION to README env table
- Link maintenance retention to env var name in data retention section
- Note metrics auth requirement in features list
- Fix clustering.md: fail-closed wording, mark AGG_STRATEGY/NODE_REGION optional
- Fix .env.example: wording (no .env loader), add TRUSTED_PROXIES + MAINT_RETENTION
- Add CLI help/usage with subcommand listing, accept serve/help/-h/-version

Docker/deploy:
- Add EXPOSE 8080 to Dockerfile
- Remove dead LIPGLOSS_RENDERER_HAS_DARK_BACKGROUND env
- Exempt /api/health from cluster auth (fixes Docker HEALTHCHECK 401)
- Add sysctls for unprivileged ping to all compose files

Cosmetic:
- Fix bug_report.yaml: SemVer placeholder, remove nonexistent serve subcommand

cmd/uptop/main.go

@@ -77,17 +77,37 @@ func main() {
 		case "export":
 			runExport(os.Args[2:])
 			return
-		case "version", "--version", "-v":
+		case "version", "--version", "-v", "-version":
 			printVersion()
 			return
 		case "migrate-secrets":
 			runMigrateSecrets(os.Args[2:])
 			return
+		case "help", "--help", "-h":
+			printUsage()
+			return
+		case "serve":
+			runServe(os.Args[2:])
+			return
 		}
 	}
 	runServe(os.Args[1:])
 }
 
+func printUsage() {
+	fmt.Fprintf(os.Stderr, `Usage: uptop <command> [flags]
+
+Commands:
+  serve             Start the server (default if no command given)
+  apply             Apply monitors from a YAML file
+  export            Export monitors to YAML
+  migrate-secrets   Re-encrypt alert credentials with current key
+  version           Print version and exit
+
+Run 'uptop serve --help' for server flags.
+`)
+}
+
 func printVersion() {
 	out := "uptop " + version
 	var meta []string