docs: self-hosted install and upgrade fixes (issue #72)

[SebConejo]

Processes the six findings of #72, recommended options, each verified before the edit.

Finding 1 (option 3) — the four Docker Run blocks published port 2099 with no PORT env, but the published image sets none and the app falls back to 3001, so the dashboard never answered on the documented port. I reproduced both halves live against manifestdotbuild/manifest:latest before editing: run as documented, curl http://localhost:2099 gets connection reset and the log reads Server running on http://0.0.0.0:3001; with -e PORT=2099, HTTP 200. The blocks now carry -e PORT=2099 and keep the open -p 2099:2099 mapping: a docker run user with their own PostgreSQL is usually on a server and wants the network access. The Custom port block gets the same one-line fix.

Finding 2 (option 1) — the pre-v6.18.0 upgrade note said bash install.sh --upgrade, but the recommended install runs the script from the network and leaves nothing on disk. The block now downloads the script first (the form the script's own header documents), with a parenthesis for --dir installs.

Finding 3 (option 1) — pinning is now MANIFEST_VERSION in .env, the only pin that survives bash install.sh --upgrade replacing the compose file (which holds no literal tag to edit: the image line is templated). Tag examples refreshed from the 5.46 line to 6.18.0 / 6.18 / 6. New "Image version" row in the environment-variables reference.

Finding 4 (option 1) — recovery paragraph at the end of the LAN section for the "Invalid origin" lockout: the admin account was really created, setup won't run again, and fixing BETTER_AUTH_URL plus docker compose up -d gets you in with the credentials you already chose.

Finding 5 (option 1) — the LAN step now tells installs exposed the old way (hand-edited ports: line) to move the change to HOST_BIND_ADDRESS before the next installer upgrade wipes it, and the Upgrading section now distinguishes the two paths: docker compose pull leaves your compose file alone, bash install.sh --upgrade replaces it after a timestamped backup, and custom edits belong in docker-compose.override.yml. Ships with finding 3 as the issue prescribed, since they share the compose-replacement fact.

Finding 6 (option 1) — the BETTER_AUTH_URL step now says a configured Google, GitHub or Discord sign-in needs its redirect URI updated in the provider's console, with the callback formula.

Coherence GREEN (48 pages, 58 vars).

Closes #72