fix: resolve 13 release-consistency findings

Documentation:
- Fix CI badge href to /actions (was 404 on Gitea)
- Add UPTOP_METRICS_PUBLIC + UPTOP_MAINT_RETENTION to README env table
- Link maintenance retention to env var name in data retention section
- Note metrics auth requirement in features list
- Fix clustering.md: fail-closed wording, mark AGG_STRATEGY/NODE_REGION optional
- Fix .env.example: wording (no .env loader), add TRUSTED_PROXIES + MAINT_RETENTION
- Add CLI help/usage with subcommand listing, accept serve/help/-h/-version

Docker/deploy:
- Add EXPOSE 8080 to Dockerfile
- Remove dead LIPGLOSS_RENDERER_HAS_DARK_BACKGROUND env
- Exempt /api/health from cluster auth (fixes Docker HEALTHCHECK 401)
- Add sysctls for unprivileged ping to all compose files

Cosmetic:
- Fix bug_report.yaml: SemVer placeholder, remove nonexistent serve subcommand

deploy/docker-compose.cluster.yml

@@ -5,6 +5,8 @@ services:
   leader:
     image: lerkolabs/uptop:latest
     container_name: uptop-leader
+    sysctls:
+      - net.ipv4.ping_group_range=0 2147483647
     ports:
       - "23234:23234" # SSH
       - "8080:8080"   # HTTP
@@ -40,6 +42,8 @@ services:
   follower:
     image: lerkolabs/uptop:latest
     container_name: uptop-follower
+    sysctls:
+      - net.ipv4.ping_group_range=0 2147483647
     ports:
       - "23233:23234" # SSH (Mapped to different host port)
       - "8081:8080"   # HTTP (Mapped to different host port)

deploy/docker-compose.probe.yml

@@ -1,6 +1,8 @@
 services:
   leader:
     image: lerkolabs/uptop:latest
+    sysctls:
+      - net.ipv4.ping_group_range=0 2147483647
     environment:
       - UPTOP_CLUSTER_MODE=leader
       - UPTOP_CLUSTER_SECRET=changeme  # EXAMPLE ONLY — rotate before use

deploy/docker-compose.yml

@@ -8,6 +8,8 @@ services:
       - ALL
     security_opt:
       - no-new-privileges:true
+    sysctls:
+      - net.ipv4.ping_group_range=0 2147483647
     tmpfs:
       - /tmp
     ports: