Move install path to /opt/theta42/proxy, secrets to /etc/proxy/secrets.js

- ops/install.sh now installs to /opt/theta42/proxy (was /var/www/proxy)
  and seeds /etc/proxy/secrets.js from secrets.js.example on first run
  (never overwritten on later runs), instead of requiring a manual
  nodejs/conf/secrets.js edit inside the repo checkout.
- ops/proxy.service points at the new install path and sets
  CONF_SECRETS=/etc/proxy/secrets.js (requires @simpleworkjs/conf >=
  1.2.0, already the pinned version) so the app picks up the secrets
  file with no symlink into the repo checkout.
- install.sh now prints the version it's updating from/to (or "Already
  up to date") on every run, instead of a silent update.
- Updated README/DEPLOYMENT/installation docs to match the new paths.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

secrets.js.example

@@ -6,13 +6,16 @@
 // direct LDAP client for user lookups. This file supplies that wiring.
 //
 // Docker / unified stack: place at ./config/proxy-secrets.js and bind-mount
-// ./config at /config (see docker-compose.yml); docker-entrypoint.sh symlinks
-// it into /app/conf/secrets.js so @simpleworkjs/conf reads it. No app_* env
+// ./config at /config (see docker-compose.yml); docker-entrypoint.sh points the
+// CONF_SECRETS env var at it so @simpleworkjs/conf reads it. No app_* env
 // should be passed — app_* env beats this file in @simpleworkjs/conf, so the
 // file is authoritative only if the matching app_* env is absent.
 //
-// Bare-metal: copy to nodejs/conf/secrets.js and fill in your values. Values
-// here override conf/base.js and win over <environment>.js.
+// Bare-metal: ops/install.sh seeds this file at /etc/proxy/secrets.js on first
+// run (with placeholders for the values it can't guess) and points the
+// systemd unit's CONF_SECRETS env var at it. Fill in your values, then
+// `sudo systemctl restart proxy`. Values here override conf/base.js and win
+// over <environment>.js.
 //
 // Only the keys the app reads are listed below. The `stack` key is read by the
 // theta-env orchestrator (setup.sh) and ignored by the app.