feat: simplify OSS local installation

[ttwj]

Summary

• replace the legacy OneCLI container-only curl installer with an ONEComputer OSS source bootstrap
• add an idempotent local setup helper for .env, secrets, PostgreSQL, Prisma, and pnpm dev
• add dry-run/help modes, safe port fallback, local database URL alignment, and no-destructive-update behavior
• document the OSS/Azure boundary and add installer shell/dry-run CI coverage

Validation

• sh -n scripts/install.sh
• sh -n scripts/onecomputer/setup.sh
• disposable Docker Compose setup with generated secrets and mode-600 .env
• PostgreSQL port fallback 5432 -> 5433 and successful rerun
• full local setup: locked pnpm install, Prisma generation, all migrations through 20260712124500_add_manager_approval_key

[ttwj]

Installer-specific validation is green: shell syntax, dry-run plans, disposable Docker Compose setup, port fallback/rerun, Prisma generation, and full local migrations. The Rust and Lint jobs fail on pre-existing repository conditions unrelated to this change: Cargo still references the internal http://127.0.0.1:3001/onecli/affinidi-tdk-rs.git mirror, and the existing API lint emits 35 warnings. Build & Type Check and the new OSS installer smoke test pass. Tracking those public-OSS dependency/lint repairs separately.