Make first-run deploy a one-command install

[soulgalore]

Today a fresh onlinetest deployment requires nine manual steps: clone, copy
.env, change four CHANGE_ME passwords, set DOMAIN in three places, sync
REDIS_PASSWORD into redis.conf, then run docker compose. The redis password
sync in particular is a known footgun — the comment in .env.example calls it
out explicitly, which is a tell that even the maintainer thinks it's annoying.

This turns the path into "git clone && ./deploy/update.sh --domain=foo.com".
update.sh detects a fresh install (no .env, or any CHANGE_ME line remaining),
auto-generates all secrets with openssl, derives RESULT_BASE_URL and
SITESPEED.IO_HTML_HOMEURL from DOMAIN, and prints the admin credential and a
DNS reminder at the end. The redis password sync is eliminated by passing
--requirepass ${REDIS_PASSWORD} via the compose command instead — redis.conf
keeps its non-secret settings. Existing users who upgrade get a one-time
migration hint about the now-ignored requirepass line.

A new GitHub Action verifies both the install logic (no CHANGE_ME left,
idempotency on re-run, redis.conf clean) and full all-in-one integration
(Caddy with internal CA on test.localhost, /api/ reachable over HTTPS).

Multi-runner onboarding is a separate piece of work — its design is captured
in deploy/EASY_DEPLOY_PLAN.md alongside the rest of the resolved decisions
and the deferred branches.

Co-authored-by: Claude noreply@anthropic.com