Add install.sh and fix service unit placeholder

- scripts/install.sh: one-command hardened deploy (creates the water-monitor
  system user, deploys to /opt, builds a uv-managed venv, installs and enables
  the systemd unit). Idempotent; excludes .env/*.db/stations.json from sync so
  runtime state is preserved.
- Fix placeholder Documentation= URL in water-monitor.service.
- README: document the script as the primary systemd install path, with manual
  steps kept as a fallback.

README.md

@@ -244,7 +244,7 @@ water_level{station_code="P.1"}
 ```sql
 -- Latest readings from all stations
 SELECT s.station_code, s.english_name, m.water_level, m.discharge
-FROM stations s 
+FROM stations s
 JOIN water_measurements m ON s.id = m.station_id
 WHERE m.timestamp = (SELECT MAX(timestamp) FROM water_measurements WHERE station_id = s.id);
 ```
@@ -267,14 +267,32 @@ docker run -d \
 
 ### Systemd Service (Linux)
 
-```bash
-# Copy service file
-sudo cp scripts/water-monitor.service /etc/systemd/system/
+The install script sets everything up: a dedicated `water-monitor` system user,
+a deploy to `/opt/thailand-water-monitor`, a uv-managed virtualenv, and the
+enabled systemd unit.
 
-# Enable and start
+```bash
+# From a checkout of the repo, as root:
+sudo bash scripts/install.sh
+
+# Then start and check:
+sudo systemctl start water-monitor.service
+systemctl status water-monitor.service
+```
+
+Fill in `/opt/thailand-water-monitor/.env` (Matrix token/room, DB settings)
+before starting if the script reports it is missing.
+
+<details>
+<summary>Manual setup (if you prefer not to use the script)</summary>
+
+```bash
+sudo useradd --system --no-create-home --shell /usr/sbin/nologin water-monitor
+sudo cp scripts/water-monitor.service /etc/systemd/system/
 sudo systemctl enable water-monitor.service
 sudo systemctl start water-monitor.service
 ```
+</details>
 
 ### Migration for Existing Systems
 
@@ -475,7 +493,7 @@ See [docs/PROJECT_STRUCTURE.md](docs/PROJECT_STRUCTURE.md) for detailed architec
 The project includes comprehensive Gitea Actions workflows:
 
 - **🧪 CI/CD Pipeline** - Automated testing, building, and deployment
-- **🔒 Security Scanning** - Daily vulnerability and dependency checks  
+- **🔒 Security Scanning** - Daily vulnerability and dependency checks
 - **📚 Documentation** - Automated API docs and validation
 - **🚀 Release Management** - Automated releases with multi-arch Docker builds