- install-service.sh: interactive password prompt (hidden input); --password/--username/--no-password and OPENCODE_SERVER_PASSWORD/USERNAME env
- credentials are written to a root-only env file (mode 600) referenced by the unit via EnvironmentFile=; the password never appears in the unit
- unit name/env path overridable for testing (OPENCODE_SERVICE_NAME, OPENCODE_ENV_FILE)
- README documents the auth option
- new install-service.sh: creates/removes the OpenCode web UI systemd service as its own process (interactive by default, flags for automation, --uninstall, --dry-run, backs up an existing unit)
- install.sh no longer embeds the service logic; run_service_setup locates the sibling script (or downloads it) and invokes it as a separate process
- README documents running install-service.sh on its own
