(ops) Install pobsync-manage for native management commands

Add a pobsync-manage wrapper that loads the native environment file before
running Django management commands, so production commands use the same
database and runtime settings as the systemd services.

Install the wrapper from the systemd installer, use it for migrations,
static collection, SSH key setup, and superuser creation, and document it
in the README for operational commands.

scripts/install-systemd

@@ -504,10 +504,21 @@ install_units() {
 
 run_step "Install systemd units" install_units
 
+install_manage_wrapper() {
+    sed \
+        -e "s|@POBSYNC_APP_DIR@|$APP_DIR|g" \
+        -e "s|@POBSYNC_VENV_DIR@|$VENV_DIR|g" \
+        -e "s|@POBSYNC_ENV_FILE@|$ENV_FILE|g" \
+        "$APP_DIR/deploy/bin/pobsync-manage" > /usr/local/bin/pobsync-manage
+    chmod 0755 /usr/local/bin/pobsync-manage
+}
+
+run_step "Install manage wrapper" install_manage_wrapper
+
 run_step "Reload systemd" systemctl daemon-reload
-run_step "Run database migrations" "$VENV_DIR/bin/python" "$APP_DIR/manage.py" migrate --noinput
-run_step "Ensure default SSH key" "$VENV_DIR/bin/python" "$APP_DIR/manage.py" ensure_pobsync_ssh_key --name default --set-global-default
-run_step "Collect static files" "$VENV_DIR/bin/python" "$APP_DIR/manage.py" collectstatic --noinput --clear
+run_step "Run database migrations" /usr/local/bin/pobsync-manage migrate --noinput
+run_step "Ensure default SSH key" /usr/local/bin/pobsync-manage ensure_pobsync_ssh_key --name default --set-global-default
+run_step "Collect static files" /usr/local/bin/pobsync-manage collectstatic --noinput --clear
 run_step "Finalize state permissions" chown -R "$SERVICE_USER:$SERVICE_GROUP" /var/lib/pobsync /var/log/pobsync
 
 superuser_exists=$("$VENV_DIR/bin/python" -c "import os; os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'pobsync_server.settings'); import django; django.setup(); from django.contrib.auth import get_user_model; print('yes' if get_user_model().objects.filter(is_superuser=True).exists() else 'no')")
@@ -519,17 +530,17 @@ if [ "$CREATE_SUPERUSER" -eq 1 ]; then
             DJANGO_SUPERUSER_USERNAME="$SUPERUSER_USERNAME" \
             DJANGO_SUPERUSER_EMAIL="$SUPERUSER_EMAIL" \
             DJANGO_SUPERUSER_PASSWORD="$SUPERUSER_PASSWORD" \
-            "$VENV_DIR/bin/python" "$APP_DIR/manage.py" createsuperuser --noinput
+            /usr/local/bin/pobsync-manage createsuperuser --noinput
         run_step "Finalize superuser permissions" chown -R "$SERVICE_USER:$SERVICE_GROUP" /var/lib/pobsync /var/log/pobsync
     else
         note_step "Create Django superuser" "SKIPPED"
         echo "No superuser password was provided; create one later with:"
-        echo "  sudo -u $SERVICE_USER $VENV_DIR/bin/python $APP_DIR/manage.py createsuperuser"
+        echo "  sudo -u $SERVICE_USER pobsync-manage createsuperuser"
     fi
 elif [ "$superuser_exists" != "yes" ]; then
     note_step "Create Django superuser" "SKIPPED"
     echo "No Django superuser exists yet. Create one with:"
-    echo "  sudo -u $SERVICE_USER $VENV_DIR/bin/python $APP_DIR/manage.py createsuperuser"
+    echo "  sudo -u $SERVICE_USER pobsync-manage createsuperuser"
 else
     note_step "Create Django superuser" "SKIPPED"
 fi
@@ -574,3 +585,4 @@ echo
 echo "Useful commands:"
 echo "  systemctl status pobsync-web pobsync-worker pobsync-scheduler"
 echo "  journalctl -u pobsync-worker -f"
+echo "  sudo -u $SERVICE_USER pobsync-manage check"