chore: Add deploy plumbing for the share service

Add a hardened systemd unit, a Caddy reverse-proxy snippet that maps
/fabula/api/* to the loopback service, and Justfile build-server/
deploy-server recipes that build a static binary and ship + restart it.
Includes server/README documenting the API, config, and deploy steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Justfile

@@ -6,8 +6,12 @@ user := "root"
 host := "goldfish.malzahn.lan"
 www-root := "/usr/share/caddy/public_html/fabula"
 
+# Target architecture of the deploy host (override: `just go-arch=arm64 deploy-server`)
+go-arch := "amd64"
+
 clean:
     rm -rf dist/*
+    rm -f server/share-svc
 
 serve:
     npm run dev
@@ -18,6 +22,16 @@ build:
 deploy: build
     scp -r dist/* {{ user }}@{{ host }}:{{ www-root }}/
 
+# Build the share service as a static binary for the deploy host.
+build-server:
+    cd server && CGO_ENABLED=0 GOOS=linux GOARCH={{ go-arch }} go build -o share-svc .
+
+# Ship the binary + unit file and (re)start the service. Requires root on host.
+deploy-server: build-server
+    scp server/share-svc {{ user }}@{{ host }}:/usr/local/bin/share-svc
+    scp server/share-svc.service {{ user }}@{{ host }}:/etc/systemd/system/share-svc.service
+    ssh {{ user }}@{{ host }} 'systemctl daemon-reload && systemctl enable --now share-svc && systemctl restart share-svc'
+
 format:
     npx prettier --write books/
     npx prettier --write src/