deploy: add systemd unit + env template, document service setup

also document WUTZ_TZ / WUTZ_DAY_CUTOFF_HOUR env vars

README.md

@@ -81,9 +81,46 @@ ADMIN_PASSWORD=... DB_PATH=/var/lib/wutzcalc/wutz.db node server/dist/index.js
 Single Node process serves the API, both client entries (`/` tablet,
 `/admin` backoffice), and writes to one SQLite file.
 
+## Run as a systemd service
+
+Template files live in [`deploy/`](deploy/): a unit ([`wutzcalc.service`](deploy/wutzcalc.service))
+and an environment file ([`wutzcalc.env.example`](deploy/wutzcalc.env.example)).
+They assume the built app lives in `/opt/wutzcalc` and the database in
+`/var/lib/wutzcalc` — adjust paths in the unit if yours differ.
+
+```sh
+# 1. Dedicated system user (no login, no home)
+sudo useradd --system --no-create-home --shell /usr/sbin/nologin wutzcalc
+
+# 2. Install the built app (run `pnpm install && pnpm build` first)
+sudo mkdir -p /opt/wutzcalc
+sudo cp -a . /opt/wutzcalc            # or rsync/checkout into place
+sudo chown -R root:root /opt/wutzcalc # app dir stays read-only to the service
+
+# 3. Config + secrets (chmod 600 — holds ADMIN_PASSWORD)
+sudo mkdir -p /etc/wutzcalc
+sudo install -m 600 deploy/wutzcalc.env.example /etc/wutzcalc/wutzcalc.env
+sudoedit /etc/wutzcalc/wutzcalc.env    # set ADMIN_PASSWORD
+
+# 4. Install and start the unit
+sudo cp deploy/wutzcalc.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now wutzcalc
+
+# Logs / status
+systemctl status wutzcalc
+journalctl -u wutzcalc -f
+```
+
+Confirm `ExecStart` matches your Node path (`command -v node`) — it defaults to
+`/usr/bin/node`. The unit creates `/var/lib/wutzcalc` via `StateDirectory`, so
+the service user owns the database directory automatically.
+
 ## Env vars
 
 - `PORT` (default `3000`)
 - `HOST` (default `0.0.0.0`)
 - `DB_PATH` (default `./wutz.db`)
 - `ADMIN_PASSWORD` (**required** for backoffice login)
+- `WUTZ_TZ` (default `Europe/Berlin`) — timezone for stats display and grouping
+- `WUTZ_DAY_CUTOFF_HOUR` (default `5`) — sales before this local hour count toward the previous business day