Run fresh installs through the shared start

[SaladDay]

What

• Fresh install, rerun and upgrade all start through apply (init → check-config → up). The fresh path no longer skips check-config.
• Init and check-config refusals are returned as themselves (last line of Docker's output); only an up failure says startup failed; data retained, rerun the installer and now lists the services that are not healthy plus docker compose -f <dir>/compose.yaml logs --tail 50 <services>. oac apply gets the same, ending in "run oac apply again".
• oac init prints its final error as a plain stderr line (audit 6).
• Ctrl-C/SIGTERM prints Interrupted; rerun the installer to continue. (oac <cmd> for other commands). The stage is removed and the lock directory reused, pinned by a test that reruns after an interrupt.
• One dockerEnv() helper strips OAC_* and COMPOSE_* from every Docker child (compose runner and dockerOutput).
• Progress: Pulling <image>…, Starting services (up to 3 minutes)….
• Rerun with differing --host/--web-port/--public-url: Ignored …; edit .env and run <dir>/oac apply.
• Success: Core key only on a fresh install, else Core key: <dir>/oac core-key --show; console origin read from compose config --format json (web's OAC_PUBLIC_URL, so it works with any compose default); the "Browsers must open exactly …" hint when a fresh install chose the origin itself (replaces the localhost-only hint).
• oac apply and rotate-core-key confirm; an unknown command prints usage once and works outside an installation; flag errors print once.
• Docs: install.md, install-options.md, operations.md, configuration.md (EN + zh, source_hash refreshed).

Why

audit-core findings 5(i), 6, 7 (install.go part), 2; P2 d, e, f, g, h, i, j, m (c, e covered here); probes-mx 4.

Findings found wrong

• OAC_REPOSITORY has callers: deploy/install.sh and install.ps1 read it for the binary download, and oac must read the same variable or a fork's installer would fetch upstream's compose. Kept.

Verification

• go vet ./... clean; go test -count=1 ./services/core/cmd/oac/ ok; python3 scripts/check-names.py ok; node --test website/tests/translations.test.mjs: tests 1-2 pass.

Skipped

• translations test 3 (needs vitepress), full make check, real Docker run (all docker calls go through the fake runner).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}