Add Linux systemd support and --install-service/--remove-service flags

The service package now has a Linux implementation alongside the Windows
one: systemd unit install/remove (/etc/systemd/system), readiness
notification (READY=1 via go-systemd) sent only after the listeners are
bound, a 30s watchdog, and STOPPING on shutdown. Listeners are pre-bound
so port conflicts fail fast and the readiness signal is truthful. The
notify calls are no-ops without NOTIFY_SOCKET (containers, shells) and
on non-Linux builds. --install-service/--remove-service work on both
platforms; the 'service install|remove' subcommand remains as an alias.

SPEC.md

@@ -163,14 +163,21 @@ Startup fails fast on unparsable values and when neither consumer URL is
 set. Enabled upstreams are probed once at start (`/api/version`,
 `/system_stats`); failure is logged, not fatal.
 
-## Native Windows deployment
+## Native deployment (Windows and Linux)
 
-The binary runs natively on Windows (the primary deployment) as well as in
-Docker.
+The binary runs natively on Windows (the current primary deployment) and on
+Linux with systemd (the future GPU server), as well as in Docker.
 
-- `gpu-turnstile.exe service install [-config path]` registers an
-  auto-start Windows service (needs an elevated shell). Recovery actions
-  restart it 5 s after any failure. `service remove` uninstalls.
+Service management is the same on both platforms:
+`gpu-turnstile --install-service [-config path]` registers and starts an
+auto-start service; `--remove-service` stops and unregisters it (both need
+an elevated/root shell). The legacy form `gpu-turnstile service
+install|remove` does the same thing.
+
+### Windows
+
+- `--install-service` registers a Windows service; recovery actions restart
+  it 5 s after any failure.
 - **Layout**: install to `C:\Program Files\gpu-turnstile\` (exe plus
   `gpu-turnstile.env`); logs belong in `C:\ProgramData\gpu-turnstile\` via
   `LOG_FILE`. The service must be able to write its install directory for
@@ -182,6 +189,27 @@ Docker.
   log directories only (no network logon, no user profile).
 - Use a config file (above) for the service — Windows services have no
   convenient environment. Logs go to `LOG_FILE` since there is no console.
+
+### Linux (systemd)
+
+- `--install-service` writes `/etc/systemd/system/gpu-turnstile.service`
+  with `ExecStart` pointing at the current executable and the `-config`
+  file, then runs `systemctl daemon-reload` and `enable --now`. The unit
+  runs as root (it must be able to overwrite its own binary for
+  self-updates); harden with `ProtectSystem=strict` plus a writable
+  `ReadWritePaths` if desired.
+- The unit is `Type=notify`: the binary sends `READY=1` via
+  `github.com/coreos/go-systemd` only after the listeners are bound, so
+  `systemctl start` blocks until the proxy accepts connections. A 30 s
+  watchdog (`WatchdogSec=`) is pinged as long as the process runs; three
+  missed pings make systemd restart it. `STOPPING=1` is sent on shutdown.
+  All notify calls are no-ops when `NOTIFY_SOCKET` is unset (containers,
+  interactive shells), and the whole integration is Linux-only — Windows
+  builds carry no-op stubs.
+- Logs go to the journal (`journalctl -u gpu-turnstile`) or to `LOG_FILE`.
+- **Auto-update** works the same as on Windows: `Restart=on-failure` with
+  `RestartSec=5s` brings up the staged binary after the updater exits with
+  code 3.
 - **Auto-update**: on startup and every `UPDATE_INTERVAL`, the binary
   checks `UPDATE_REPO`'s latest release; if its tag is a newer `vX.Y.Z`,
   it downloads `UPDATE_ASSET` plus its `.sig` (and `.sha256` when present)
@@ -250,7 +278,7 @@ gpu-turnstile/
   internal/metrics/          # Prometheus exposition
   internal/config/           # env + .env file configuration
   internal/update/           # signed auto-updater (public key in pubkey.go)
-  internal/service/          # Windows service integration
+  internal/service/          # Windows SCM + Linux systemd (notify/watchdog) integration
   Dockerfile
   .gitea/workflows/ci.yml
   README.md
@@ -278,8 +306,9 @@ are new.
 
 ## Build and CI
 
-- Go 1.23+, `golang.org/x/sys` is the only external dependency (Windows
-  service integration; not used in the Linux build). `CGO_ENABLED=0`,
+- Go 1.23+, two external dependencies: `golang.org/x/sys` (Windows service
+  integration) and `github.com/coreos/go-systemd` (systemd notify/watchdog,
+  Linux build only). `CGO_ENABLED=0`,
   `-ldflags="-s -w"`, version from `git describe` injected via
   `-X main.version=`.
 - Dockerfile: multi-stage, final image `gcr.io/distroless/static` (or