case 4690 - setup script: Ubuntu 26.04 support, unique secrets per server, no phased updates

- PostgreSQL from the PostgreSQL project's repository via postgresql-common's
  apt.postgresql.org.sh (apt-key is gone on newer Ubuntu)
- libgdk-pixbuf2.0-0 renamed libgdk-pixbuf-2.0-0 (needed on 26.04, also valid on 24.04)
- random PostgreSQL password and JWT secret per server, written to PostgreSQL and
  config.json (replacing the shipped defaults) and to /root/ayanova-secrets.txt (600)
- config.json 640 root:www-data
- APT::Get::Never-Include-Phased-Updates, as set by hand on every server today

Tested end to end on a fresh Ubuntu 26.04.1 droplet with the 8.3.0 build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/views/biz-subscription-server.vue

@@ -1362,6 +1362,8 @@ DOMAINNAME='${m.vm.obj.name}'
 #############################
 echo STARTING...
 timedatectl set-timezone $TIMEZONE
+# no phased updates, so weekly updates match what was tested on devtest first
+echo 'APT::Get::Never-Include-Phased-Updates "true";' > /etc/apt/apt.conf.d/52no-phasing
 apt-get update
 apt-get dist-upgrade -y
 dpkg-reconfigure unattended-upgrades
@@ -1375,17 +1377,24 @@ echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf
 echo 'vm.vfs_cache_pressure=50' | sudo tee -a /etc/sysctl.conf
 echo INSTALL .NET CORE
 apt-get install -y aspnetcore-runtime-10.0
+echo GENERATE SERVER SECRETS
+# unique per server, letters and digits only so they are safe in SQL, JSON and the connection string
+DBPASSWORD=$(openssl rand -hex 24)
+JWTSECRET=$(openssl rand -hex 16)
+echo "PostgreSQL postgres password: $DBPASSWORD" > /root/ayanova-secrets.txt
+echo "AYANOVA_JWT_SECRET: $JWTSECRET" >> /root/ayanova-secrets.txt
+chmod 600 /root/ayanova-secrets.txt
 echo INSTALL POSTGRESQL
-sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
-wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
-sudo apt-get update
+# PostgreSQL project repository (same PostgreSQL build on every Ubuntu release); apt-key no longer exists on newer Ubuntu
+apt-get install -y postgresql-common
+/usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
 sudo apt-get -y install postgresql
-sudo -u postgres psql -U postgres -d postgres -c "alter user postgres with password 'YOUR_PASSWORD_HERE';"
+sudo -u postgres psql -U postgres -d postgres -c "alter user postgres with password '$DBPASSWORD';"
 echo INSTALL REPORTING LIBS
 
-# Ubuntu 24.04
+# Ubuntu 24.04 and 26.04
 sudo apt-get update
-sudo apt-get install -y libatk1.0-0t64 libc6 libcairo2 libdbus-1-3 libexpat1 libfontconfig1 libgcc-s1 libgdk-pixbuf2.0-0 libglib2.0-0t64 libgtk-3-0t64 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libnss3 lsb-release libgbm-dev xdg-utils 
+sudo apt-get install -y libatk1.0-0t64 libc6 libcairo2 libdbus-1-3 libexpat1 libfontconfig1 libgcc-s1 libgdk-pixbuf-2.0-0 libglib2.0-0t64 libgtk-3-0t64 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libnss3 lsb-release libgbm-dev xdg-utils 
 sudo apt-get update
 sudo apt-get install -y libatk-bridge2.0-0t64 libcups2t64 libxcomposite1 libxdamage1 libpangocairo-1.0-0 libxfixes3 libxrandr2 libgbm1 libcairo2 libpango-1.0-0 libasound2t64 wget
 # NOTE: for future releases of ubuntu when need to update packages this was helpful https://itsfoss.com/unable-to-locate-package-error-ubuntu/
@@ -1395,9 +1404,14 @@ mkdir /var/ayanova
 mkdir /var/ayanova/data
 cd /var/ayanova
 curl -O https://www.ayanova.com/download/ayanova-subscription-linux-x64-server.zip && unzip -o ayanova-subscription-linux-x64-server.zip
+# put this server's own secrets in place of the shipped defaults
+sed -i "s/Password=YOUR_PASSWORD_HERE;/Password=$DBPASSWORD;/" /var/ayanova/config.json
+sed -i "s/12345YourRandom32CharacterSecret/$JWTSECRET/" /var/ayanova/config.json
 chown -vR :www-data /var/ayanova
 chmod -R g+rw /var/ayanova/data
 chmod g+rw /var/ayanova/
+# config.json holds the database password: readable by root and the service group only
+chmod 640 /var/ayanova/config.json
 echo '[Unit]' >> /etc/systemd/system/ayanova.service
 echo 'Description=AyaNova server' >> /etc/systemd/system/ayanova.service
 echo '' >> /etc/systemd/system/ayanova.service