refactor: replace install.sh with Python install.py

docs/configuration.md

@@ -160,7 +160,7 @@ NUNTIUS_SMTP_PASSWORD=actual-app-password
 EnvironmentFile=/etc/nuntius/.env
 ```
 
-The `install.sh` helper script sets the file mode automatically.
+The `install.py` helper script sets the file mode automatically.
 
 ## Defaults at a Glance
 

docs/deployment.md

@@ -37,7 +37,7 @@ rsync -avz \
     user@your-server:/tmp/nuntius/
 ```
 
-> `install.sh` lives in the repository root. The systemd unit is included inline in Option A below (you do not need to rsync it from the repo). `.env.example` is a template for the secrets file. Adjust the `rsync` source list to match what you keep checked in.
+> `install.py` lives in the repository root. The systemd unit is included inline in Option A below (you do not need to rsync it from the repo). `.env.example` is a template for the secrets file. Adjust the `rsync` source list to match what you keep checked in.
 
 ## 2. Install on the Server (SSH Session)
 
@@ -97,7 +97,7 @@ sudo journalctl -u nuntius -f
 
 The service file expects the binary at `/usr/local/bin/nuntius`, the env file at `/etc/nuntius/.env`, and the data dir at `/var/lib/nuntius` (the config's `data_dir: "./data"` resolves to `/var/lib/nuntius/data` because the unit sets `WorkingDirectory=/var/lib/nuntius`). If you'd rather use `/opt/nuntius/...` or any other layout, edit the systemd unit block above before installing.
 
-### Option B — `install.sh` (idempotent)
+### Option B — `install.py` (idempotent)
 
 Before running the script, copy the systemd unit from the block in Option A above into `/tmp/nuntius/nuntius.service` (the script reads it from the current working directory):
 
@@ -106,7 +106,7 @@ ssh user@your-server
 cd /tmp/nuntius
 # Paste the [Unit]…[Install] block from Option A into this file:
 sudo $EDITOR /tmp/nuntius/nuntius.service
-sudo bash install.sh
+sudo python3 install.py
 ```
 
 The script is idempotent: re-running on an already-installed host is safe. It:

docs/security.md

@@ -100,7 +100,7 @@ Things nuntius does **not** do:
 
 Things you should do:
 
-- Make sure `/etc/nuntius/.env` is `0600` and owned `root:nuntius` (the `install.sh` script does this for you).
+- Make sure `/etc/nuntius/.env` is `0600` and owned `root:nuntius` (the `install.py` script does this for you).
 - Use an app-specific password or OAuth token if your provider supports it. nuntius uses `PLAIN` auth because that is what every SMTP provider offers; the credential is the secret, not the auth mechanism.
 - Rotate the password on the same cadence as any other production secret.
 - Restrict read access to `journalctl -u nuntius` if you do not want the client IPs in your local log files.