feat(socket-auth): generate the socket auth key on install

[roncodes]

What

flb install-fleetbase now configures realtime socket authentication:

• Generates SOCKETCLUSTER_AUTH_KEY with crypto.randomBytes(32) (64 hex chars) and writes it, together with SOCKETCLUSTER_AUTH_MODE=enforce, to the project-root .env (next to docker-compose.yml).
• On re-run, an existing key of 32+ characters and an existing mode are kept (a shorter key is replaced with a warning). Other lines in .env are left untouched; the file is written with mode 600.
• SOCKETCLUSTER_OPTIONS origins are still written to docker-compose.override.yml as before.
• The post-install summary lists "Socket authentication (; key in .env)".
• README documents the two variables.

Why

fleetbase/fleetbase#704 replaces the stock SocketCluster image with fleetbase/fleetbase-socket, which authenticates subscriptions using a secret shared with the API. Its docker-compose.yml passes ${SOCKETCLUSTER_AUTH_KEY:-} / ${SOCKETCLUSTER_AUTH_MODE:-} from the project .env to the application, queue, scheduler and socket containers, so the key must live there (setting it in api/.env has no effect). This mirrors what scripts/docker-install.sh does in that PR. Keeping the key across re-runs avoids invalidating socket tokens already issued.

Test plan

• Verified by CI (this repo has no test suite).
• Manual: fresh flb install-fleetbase --non-interactive creates .env with a 64-char key and enforce; re-running keeps the same key and mode; a pre-set SOCKETCLUSTER_AUTH_MODE=log is preserved.

Related PRs

Part of the authenticated realtime channels rollout (socket auth), one PR per repo:

• feat(socket-auth): authenticated realtime channels (tokens, authorizer, signed publish) core-api#290 — tokens, channel authorizer, signed HTTP publish (merge and tag first: fleetops and storefront require fleetbase/core-api ^1.6.69)
• feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel fleetops#358 — fleetops channel resolvers, driver socket tokens, per-customer tracking channel
• feat(socket-auth): storefront customer and checkout socket tokens, channel resolvers storefront#113 — customer and checkout socket tokens, storefront/checkout resolvers
• feat(socket-auth): Fleetbase socket server with JWT auth and signed internal publish fleetbase#704 — fleetbase/fleetbase-socket server, compose/helm/installer, console socket test page
• feat(socket-auth): authenticate the realtime socket with session socket tokens ember-core#97 — console socket service authenticates with session tokens
• feat(socket-auth): show channel authorization failures in the sockets viewer dev-engine#51 — sockets viewer shows authorization failures
• feat(socket-auth): authenticate realtime socket with driver socket tokens navigator-app#112 — driver app socket tokens
• feat(socket-auth): authenticate realtime socket with customer and checkout socket tokens storefront-app#65 — customer and checkout socket tokens
• feat(socket-auth): generate the socket auth key on install #11 — installer generates the socket auth key
• feat(socket-auth): add socket.token() to mint realtime socket tokens fleetbase-js#45, feat(socket-auth): add customer.socketToken() for realtime channels storefront-js#22, feat(socket-auth): add socket->token() to mint realtime socket tokens fleetbase-php#28 — SDK socket token helpers
• docs(socket-auth): authenticated realtime channels and migration guide fleetbase.io#120 — docs and migration guide