feat: add AliasVault container and installation scripts; update Colanode setup instructions

install/colanode-install.sh

@@ -52,6 +52,8 @@ msg_ok "Configured Application"
 
 msg_info "Configuring Nginx"
 create_self_signed_cert "colanode"
+# Make cert available for browser import (required for Service Worker to work)
+cp /etc/ssl/colanode/colanode.crt /var/www/colanode/colanode.crt
 cat <<EOF >/etc/nginx/sites-available/colanode
 server {
     listen 4000 ssl;
@@ -62,6 +64,10 @@ server {
     ssl_certificate /etc/ssl/colanode/colanode.crt;
     ssl_certificate_key /etc/ssl/colanode/colanode.key;
 
+    # Required for SharedArrayBuffer / OPFS SQLite (WASM)
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+
     # Proxy API and WebSocket traffic to the Node.js server
     location ~ ^/(config|client)(/.*)?$ {
         proxy_pass http://127.0.0.1:3000;
@@ -74,6 +80,11 @@ server {
         proxy_set_header X-Forwarded-Proto \$scheme;
     }
 
+    # Serve self-signed cert for browser import
+    location = /colanode.crt {
+        default_type application/x-x509-ca-cert;
+    }
+
     location / {
         try_files \$uri \$uri/ /index.html;
     }