feat: replace PM2 with systemd --user services for production

Runs tssbot-web, tssbot-webhook, and tssbot-backend as systemd --user
units instead of PM2 processes. tssbot-web moves from a 2-worker PM2
cluster to a single instance, so deploys now restart it directly
instead of doing a zero-downtime cluster reload.

webhook.cjs now shells out to `systemctl --user restart` instead of
`pm2 reload`, and PM2_RESTART_TARGETS/WEBHOOK_PM2_NAME are renamed to
RESTART_TARGETS/WEBHOOK_SERVICE_NAME. scripts/install-systemd-services.sh
symlinks the new unit files into ~/.config/systemd/user and enables them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/install-systemd-services.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Installs/updates the tssbot-web systemd --user units and (re)starts them.
+# Run this after cloning, and again any time a unit file under systemd/ changes.
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+unit_dir="${HOME}/.config/systemd/user"
+mkdir -p "${unit_dir}"
+
+for unit in tssbot-web tssbot-webhook tssbot-backend; do
+  ln -sf "${repo_dir}/systemd/${unit}.service" "${unit_dir}/${unit}.service"
+done
+
+systemctl --user daemon-reload
+systemctl --user enable --now tssbot-web.service tssbot-webhook.service tssbot-backend.service
+
+if [ "$(loginctl show-user "$(whoami)" -p Linger --value 2>/dev/null)" != "yes" ]; then
+  echo "Linger is not enabled for $(whoami) — user services will stop when you log out."
+  echo "Enable it with: sudo loginctl enable-linger $(whoami)"
+fi
+
+systemctl --user status --no-pager tssbot-web.service tssbot-webhook.service tssbot-backend.service