feat: add worker install and deploy

docs/private-workers.md

@@ -113,8 +113,25 @@ type, control host access:
 - Compose mutation: separate high-risk capability, disabled by default;
 - Raft voter: durable fsync-capable cluster data directory and mTLS transport.
 
-`CAP_NET_RAW` is granted only for ping/traceroute features. The worker remains
-unprivileged otherwise.
+The simple systemd installer currently runs the worker as root, matching the
+minimal host-install model. Docker runs with the image's unprivileged user and
+adds `NET_RAW` for ping/traceroute. A future hardened systemd profile can use a
+dedicated user and narrow capabilities when host inventory requirements are
+finalized.
+
+The standalone binary provides two systemd installation paths:
+
+- `rsmon-worker install` installs the current binary locally and writes the
+  worker URL/token to a root-owned mode-0600 environment file; `--docker`
+  installs a systemd-managed prebuilt image instead;
+- `rsmon-worker deploy` verifies an SSH host key, uploads the binary and a
+  temporary mode-0600 environment file, and invokes `install` remotely;
+  `--docker` uploads only the environment and unit, then pulls on the target.
+
+Both default to `https://rsmon.ru` and accept `--token-file` for automation.
+Direct secret flags are supported but can be visible in process listings; file
+options are preferred. SSH login credentials, sudo credentials, and the worker
+token remain separate.
 
 ## Worker Self-Monitoring