Merge claude/2

Audited every doc against the code. Three fixes:
- system-footprint.md: add the libreportal-crowdsec root helper row
  (init.sh installs 8 helpers; the table listed 7). appcfg row clarified
  to 'CrowdSec-bouncer' config since the new helper does the host install.
- .gitattributes: add 'site export-ignore' — development.md documents the
  website as never-shipping, but the rule was missing, so site/ was landing
  in release tarballs. No runtime refs to site/; hosting lives in the Infra repo.
- promise.md: fix LICENSE link (../../LICENSE) after the docs/ reshuffle.

Everything else (install-and-use, development, contributing) verified current:
all install/uninstall/update flags, release scripts, fetch fns, footprint_version,
service name, and config keys check out against the code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

.gitattributes

@@ -3,6 +3,7 @@
 # trees never ship in libreportal-<ver>.tar.gz.
 scripts/unused    export-ignore
 scripts/release   export-ignore
+site              export-ignore
 docs              export-ignore
 .claude           export-ignore
 .gitignore        export-ignore

docs/architecture/system-footprint.md

@@ -35,7 +35,8 @@ together in **`/usr/local/lib/libreportal/`**; everything else is named
 | `libreportal-socket` | root | docker-socket read perms (type switcher) |
 | `libreportal-svc` | root | generate/install the task-processor systemd unit |
 | `libreportal-bininstall` | root | install the restic/kopia backup-engine binaries |
-| `libreportal-appcfg` | root | rewrite AdGuard/CrowdSec/ownCloud config files |
+| `libreportal-appcfg` | root | rewrite AdGuard/CrowdSec-bouncer/ownCloud config files |
+| `libreportal-crowdsec` | root | install/manage the host-side CrowdSec agent + firewall bouncer |
 
 These are the scoped-sudoers trust boundary: root-owned in a root-owned dir, so the
 manager can `sudo` them but can't modify them. Each bakes the three roots + the

docs/guide/promise.md

@@ -7,7 +7,7 @@ to you — in plain language, so you can hold us to it.
 
 You can **run, study, modify, share, and fully use 100% of LibrePortal —
 every feature — for free, forever.** The entire platform is licensed under
-the GNU AGPLv3 (see [LICENSE](LICENSE)). There are **no feature paywalls in
+the GNU AGPLv3 (see [LICENSE](../../LICENSE)). There are **no feature paywalls in
 the software, no crippled "community edition," and no telemetry** phoning
 home.