Add one-click install script with automatic secret generation

- Create scripts/install.sh that auto-generates Ed25519 signing key,
  JWT secret, Postgres and MinIO passwords from .env.example placeholders
- Add startup validation in server to reject placeholder secrets
- Add 401 interceptor in console API client to clear stale JWT tokens
- Update README Quick Start to use ./scripts/install.sh
- Update .env.example with GENERATE_ME placeholders for all secrets

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -85,19 +85,27 @@ The result is a complete, verifiable history of everything your AI agents have e
 git clone https://github.com/Elydora-Infrastructure/Elydora-Open-Source.git
 cd Elydora-Open-Source
 
-# Copy and edit environment configuration
-cp .env.example .env
-
-# Generate Ed25519 signing keys for the server and initial admin
-./scripts/generate-keys.sh
-
-# Start all services (API, PostgreSQL, MinIO, Redis)
-docker compose up -d
-
-# Verify the server is healthy
-curl http://localhost:8787/v1/health
+# One-click install — generates all secrets and starts every service
+./scripts/install.sh
 ```
 
+The install script automatically:
+
+1. Checks prerequisites (Docker, Docker Compose, OpenSSL, curl)
+2. Generates a `.env` with fresh cryptographic secrets (Ed25519 signing key, JWT secret, database and object-store passwords)
+3. Starts all services via `docker compose up -d`
+4. Waits for the API to become healthy
+
+Once complete, open:
+
+| Service | URL |
+|---------|-----|
+| Console | http://localhost:3000 |
+| API | http://localhost:8787 |
+| MinIO Console | http://localhost:9001 |
+
+> **Re-running is safe.** If `.env` already exists, the script skips secret generation and only restarts services.
+
 ### Kubernetes Deploy
 
 ```bash