v1 readiness: correctness fixes, edge hardening, auto-TLS, load balancing, ops

[mirkobrombin]

Brings GoUp to a credible v1.0: closes the remaining correctness bugs, adds the edge/TLS/ops features a public web server is expected to have, and hardens CI, validation, and docs. Every change was built, vetted, race-tested, and the load-bearing ones were exercised end-to-end.

Correctness fixes

• Plugin child processes (Node.js, Python, Docker) are now terminated on shutdown and restart via PluginManager.ExitPlugins() instead of being orphaned holding their ports.
• On-the-fly gzip no longer breaks HTTP 304 revalidation (inbound If-None-Match is normalised). Verified: revalidation now returns 304.
• API and Dashboard servers set read/idle timeouts (slowloris hardening on the pre-auth surface).
• Removed a goroutine/buffer leak in Logger.Writer() (direct line-buffered writer, no pipe/goroutine per spawned process).
• Docker API errors are no longer treated as a successful container list; forwarded UDP DNS responses are truncated with the TC bit.
• LoadAllConfigs no longer loads conf.global.json as a phantom site; DockerStandard only pulls/builds when enabled.
• API/Dashboard bind address is configurable (api_bind, dashboard_bind).

New capabilities

• Automatic TLS via ACME/Let's Encrypt (TLS-ALPN-01) with on-disk caching and renewal (ssl.acme).
• Load balancing across multiple upstreams with passive health checks, ejection and failover (proxy_upstreams). Verified: round-robin + failover on a killed backend with no 502.
• Edge hardening: per-IP rate limiting, IP allow/deny lists, request body limit, CORS, security headers, HSTS, HTTP-to-HTTPS redirect, Cache-Control.
• Config hot reload on SIGHUP (and systemctl reload); log retention purge.
• goup version / --version with release-injected build metadata.

Config, CI, ops, docs

• goup validate now does real semantic validation: rejects unknown JSON fields, checks cert/root paths, port ranges, and cross-site conflicts (duplicate domains, SSL/non-SSL port mix). Shared SiteConfig.Validate() used by the CLI and the API. Verified end-to-end.
• CI runs gofmt, vet, staticcheck, govulncheck, and race-enabled tests on push and PR; release builds embed version metadata and publish SHA-256 checksums.
• systemd unit (init/goup.service), Dockerfile, .dockerignore, and a production deployment guide (docs/production.md).
• README corrected (stop/restart are implemented; full config reference; production positioning) and a CHANGELOG.md added.
• Added tests for config validation and edge middleware.

Verification

• go build ./... (+ web_only / dns_only), go vet, gofmt: clean.
• go test -race ./...: all green.
• staticcheck: only two pre-existing SA6002 (the httputil.BufferPool interface requires []byte pools).
• govulncheck ./...: 0 vulnerabilities.

Not verified in this environment

• Full ACME certificate issuance requires a public domain and Let's Encrypt reachability; only the startup path (manager wiring, safe boot, cache dir) was exercised here.