Make setup ISO-only

Remove legacy online installer entrypoints, collapse migrations for 4.0, and move setup responsibilities into target-side system, hardware, and user commands.

install/config/firewall.sh

@@ -0,0 +1,19 @@
+# Allow nothing in, everything out.
+ufw default deny incoming
+ufw default allow outgoing
+
+# Allow ports for LocalSend.
+ufw allow 53317/udp
+ufw allow 53317/tcp
+
+# Allow Docker containers to use DNS on host.
+ufw allow in proto udp from 172.16.0.0/12 to 172.17.0.1 port 53 comment 'allow-docker-dns'
+ufw allow in proto udp from 192.168.0.0/16 to 172.17.0.1 port 53 comment 'allow-docker-dns'
+
+# Turn on Docker protections.
+ufw-docker install
+
+# Installs are followed by reboot, so configure UFW to start on the installed
+# system instead of mutating the live install session's firewall.
+sed -i 's/^ENABLED=.*/ENABLED=yes/' /etc/ufw/ufw.conf
+systemctl enable ufw