Richer final report from install.sh

The post-install summary now prints:

- Configured URL plus a live HTTP probe through Caddy so operators
  see immediately whether the stack is actually reachable.
- Every non-loopback IPv4 the host advertises (with interface
  name) so they know which addresses work on the LAN before DNS is
  set up.
- A colour-coded service status table built from docker compose ps
  (NAME, SERVICE, STATE, HEALTH, PORTS).
- A complete configuration block: TLS mode + explanatory note,
  Ollama mode and URL, external AI status with which provider keys
  were supplied, Resend, Entra OIDC.
- The secrets backup path with the standing "copy this off the
  server" warning.
- An operate / files cheatsheet so common follow-ups are at hand.

The probe hits the public root URL (not /api/health which doesn't
exist externally) and treats any 2xx/3xx as reachable.