pelican: pin DB_CONNECTION=sqlite, note CLI install path

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/pelican.nix

@@ -20,8 +20,16 @@
 # login, so its account is a second, redundant gate — replacing it means
 # standing up Authelia's OIDC provider and pointing Pelican's Socialite at it.
 #
+# The web installer at /installer is unusable in v1.0.0-beta36: routes/base.php
+# exempts that GET route from RedirectIfNotInstalled, but bootstrap/app.php
+# appends the same middleware to the whole `web` group, which is what Livewire's
+# update endpoint runs under. So every wizard click POSTs and gets 302'd back to
+# step 1 while APP_INSTALLED=false. Installed from the CLI instead — migrate,
+# then flip APP_INSTALLED=true in /var/lib/pelican-panel/.env. Recheck on the
+# next image bump; if fixed, a fresh install can use the wizard again.
+#
 # FIRST-RUN (wings crash-loops until step 3 — that's expected):
-#   1. https://panel.nordhammer.it → installer wizard, make admin user.
+#   1. Admin user: docker exec -it -u 82 pelican-panel php artisan p:user:make
 #   2. Admin → Nodes → Create. FQDN node.nordhammer.it, SSL *on*, port 443
 #      (nginx terminates TLS and proxies to wings' plain :8080 below).
 #      Allocations: IP 10.0.0.1, ports 25565-25600 (matches ports.toml).
@@ -62,6 +70,11 @@
         # upstream. This also switches the bundled Caddy to plain :80 with
         # auto_https off, so no custom Caddyfile is needed.
         BEHIND_PROXY = "true";
+        # Also required: once APP_INSTALLED=true the entrypoint blocks on
+        # `nc -z $DB_HOST $DB_PORT` for anything that isn't the literal string
+        # "sqlite". Unset means an endless "nc: bad port ''" boot loop, even
+        # though sqlite is already the app's own default.
+        DB_CONNECTION = "sqlite";
         APP_ENV = "production";
         APP_DEBUG = "false";
         # Without this Laravel sees the container's own IP and renders http://