Public web-only release: SvxPortal front-end + auth backend, install templates and INSTALL.md

Stripped from the internal repo: per-box deploy trees, Go services (nodelist/astmeta/proxy/svxdr),
deploy/sync scripts and all secrets. Config templates for nginx, PHP-FPM, Redis and tmpfiles
live in install/ with CHANGEME placeholders.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

auth/lib/acl.php

@@ -0,0 +1,15 @@
+<?php
+declare(strict_types=1);
+// acl.php — shared PHP helper for every web (dmr-web, svx-web).
+// Canonical copy: callmgr2/www-mumien/auth/lib/acl.php; other repos carry a COPY.
+// Admin-on-admin checks. Needs acct_admin_level() and json_out() from the site.
+
+// An admin may change another account only when their own level is strictly
+// higher (and may always change themselves).
+function require_privilege(string $acting_uuid, int $acting_level, string $target_uuid): void {
+  if ($target_uuid === $acting_uuid) return;
+  $target_level = acct_admin_level($target_uuid);
+  if ($target_level >= $acting_level) {
+    json_out(['ok' => false, 'error' => 'insufficient_privilege'], 403);
+  }
+}