Fix 404s: serve UI templates/static from configurable ui-root, not CWD

The web UI 404'd in production because templates/static were loaded
via relative paths ("internal/ui/templates", "internal/ui/static"),
which only resolved when running from the repo checkout. systemd sets
WorkingDirectory=/var/lib/wireguard-ui-multi, so those paths never
existed there.

Add a -ui-root flag (default /usr/local/share/wireguard-ui-multi/ui),
have install.sh copy internal/ui there, and resolve templates/static
paths through it instead of hardcoded relative strings.

Also add release-binary fast path to bootstrap.sh (falls back to
source build with CGO_ENABLED=0/-trimpath if no release exists yet),
and document real hardware/build-RAM requirements in the README.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bootstrap.sh

@@ -13,14 +13,18 @@ REPO_URL="https://gitea.perlbach24.de/scripte/wireguard-ui-multi.git"
 REF="main"
 SRC_DIR="/opt/wireguard-ui-multi-src"
 GO_VERSION="1.22.5"
+RELEASE_BASE_URL="https://gitea.perlbach24.de/scripte/wireguard-ui-multi/releases/download"
+SKIP_RELEASE=0
 
 while [[ $# -gt 0 ]]; do
 	case "$1" in
 		--ref) REF="$2"; shift 2 ;;
 		--src-dir) SRC_DIR="$2"; shift 2 ;;
 		--repo-url) REPO_URL="$2"; shift 2 ;;
+		--release-base-url) RELEASE_BASE_URL="$2"; shift 2 ;;
+		--no-release) SKIP_RELEASE=1; shift ;;
 		-h|--help)
-			echo "Usage: $0 [--ref <branch>] [--src-dir <path>] [--repo-url <url>]" >&2
+			echo "Usage: $0 [--ref <branch>] [--src-dir <path>] [--repo-url <url>] [--no-release]" >&2
 			exit 1
 			;;
 		*) echo "Unknown option: $1" >&2; exit 1 ;;
@@ -38,26 +42,7 @@ apt-get update
 apt-get install -y git wireguard-tools nftables curl ca-certificates
 
 export PATH="/usr/local/go/bin:/usr/local/bin:$PATH"
-
-if ! command -v go >/dev/null 2>&1; then
-	echo "Installing Go ${GO_VERSION}..."
-	ARCH="$(dpkg --print-architecture)"
-	curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tar.gz
-	rm -rf /usr/local/go
-	tar -C /usr/local -xzf /tmp/go.tar.gz
-	ln -sf /usr/local/go/bin/go /usr/local/bin/go
-	rm -f /tmp/go.tar.gz
-fi
-
-if [[ ! -f /etc/profile.d/go-path.sh ]]; then
-	echo 'export PATH="/usr/local/go/bin:$PATH"' > /etc/profile.d/go-path.sh
-	chmod 0644 /etc/profile.d/go-path.sh
-fi
-
-if ! command -v go >/dev/null 2>&1; then
-	echo "go still not found on PATH after install attempt (/usr/local/go/bin)." >&2
-	exit 1
-fi
+ARCH="$(dpkg --print-architecture)"
 
 if [[ -d "$SRC_DIR/.git" ]]; then
 	echo "Updating existing checkout at $SRC_DIR..."
@@ -69,11 +54,47 @@ else
 	rm -rf "$SRC_DIR"
 	git clone --depth 1 --branch "$REF" "$REPO_URL" "$SRC_DIR"
 fi
-
-echo "Building wireguard-ui-multi..."
 cd "$SRC_DIR"
-go mod tidy
-go build -o wireguard-ui-multi ./cmd/wireguard-ui-multi
+
+BIN_READY=0
+if [[ "$SKIP_RELEASE" -eq 0 ]]; then
+	RELEASE_ASSET_URL="${RELEASE_BASE_URL}/${REF}/wireguard-ui-multi-linux-${ARCH}"
+	echo "Trying prebuilt release binary: $RELEASE_ASSET_URL"
+	if curl -fsSL "$RELEASE_ASSET_URL" -o wireguard-ui-multi.tmp; then
+		mv wireguard-ui-multi.tmp wireguard-ui-multi
+		chmod 0755 wireguard-ui-multi
+		BIN_READY=1
+		echo "Using prebuilt release binary (skipped local Go build)."
+	else
+		rm -f wireguard-ui-multi.tmp
+		echo "No prebuilt release binary available, building from source instead."
+	fi
+fi
+
+if [[ "$BIN_READY" -eq 0 ]]; then
+	if ! command -v go >/dev/null 2>&1; then
+		echo "Installing Go ${GO_VERSION}..."
+		curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tar.gz
+		rm -rf /usr/local/go
+		tar -C /usr/local -xzf /tmp/go.tar.gz
+		ln -sf /usr/local/go/bin/go /usr/local/bin/go
+		rm -f /tmp/go.tar.gz
+	fi
+
+	if [[ ! -f /etc/profile.d/go-path.sh ]]; then
+		echo 'export PATH="/usr/local/go/bin:$PATH"' > /etc/profile.d/go-path.sh
+		chmod 0644 /etc/profile.d/go-path.sh
+	fi
+
+	if ! command -v go >/dev/null 2>&1; then
+		echo "go still not found on PATH after install attempt (/usr/local/go/bin)." >&2
+		exit 1
+	fi
+
+	echo "Building wireguard-ui-multi from source..."
+	go mod tidy
+	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o wireguard-ui-multi ./cmd/wireguard-ui-multi
+fi
 
 echo "Running native installer..."
 bash scripts/install.sh