Add a real global keep CLI instead of npm run cli --

npm run cli -- <args> only works from inside this repo's directory,
which is awkward everywhere but especially on a deploy host running
this alongside a dozen other projects. scripts/install-cli.sh builds
the CLI and symlinks dist/cli/index.js onto PATH (~/.local/bin by
default, no root/global npm install needed) as a real `keep` command,
runnable from anywhere.

Symlinked rather than copied, so a future `git pull && npm run build`
is the entire upgrade story -- no need to re-run the install script
after the first time.

Verified: keep --help and keep identity show both work correctly from
unrelated directories (/tmp, $HOME) after running the install script,
confirming no hidden cwd dependency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -1,6 +1,9 @@
 PORT=3050
 DATA_DIR=./data
 
+# Image to run via docker compose, e.g. repo.example.com/owner/keep:latest
+IMAGE=
+
 # Gates recipient add/remove and revoke. Unset disables /api/admin/* (503)
 # but push/pull/grant keep working for already-registered recipients.
 ADMIN_PASSWORD=change-me