server: multi-address listeners, env-file config, self-update timer + checksums

- Comma-separated ECHOLOT_{CONTROL,UDP,TCP}_LISTEN; one listener/socket per
  address. Explicit binds matter on multi-IP hosts (a wildcard would also
  claim the SSH-only management address) and per-address UDP sockets are
  the substrate stun-5780 needs.
- systemd unit reads /etc/echolot-server.env (seeded once, never
  overwritten); --install-systemd with --self-update-api also installs a
  daily randomized update timer that try-restarts the service.
- selfupdate: SHA256SUMS verification is now mandatory before the atomic
  replace (integrity, not authenticity — signing still TODO).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/README.md

@@ -65,7 +65,22 @@ sudo /usr/local/bin/echolot-server --uninstall-systemd
 ```
 
 Config precedence: flags > `ECHOLOT_*` env > defaults. Every flag has an env twin
-(`--udp-listen` ↔ `ECHOLOT_UDP_LISTEN`).
+(`--udp-listen` ↔ `ECHOLOT_UDP_LISTEN`). Host config lives in `/etc/echolot-server.env`
+(seeded by `--install-systemd`, never overwritten).
+
+**Multi-IP hosts:** listen specs are comma-separated, and you should bind explicit addresses —
+a wildcard bind would also claim management-only IPs:
+
+```sh
+ECHOLOT_CONTROL_LISTEN=203.0.113.10:8443,[2001:db8::10]:8443
+ECHOLOT_UDP_LISTEN=203.0.113.10:8442,203.0.113.11:8442,[2001:db8::10]:8442,[2001:db8::11]:8442
+```
+
+Passing `--self-update-api` to `--install-systemd` additionally installs a daily randomized
+self-update timer (`echolot-server-update.timer`) that restarts the service after a successful
+update. Updates are checksum-verified against the release's `SHA256SUMS` (integrity, not
+authenticity — signature verification remains TODO before treating the update source as
+untrusted).
 
 ### Self-update (opt-in, native only)