feat: add headless-setup-script and OpenSpec artifacts

Implement a 'one-liner' installation script for the MPVJ (Modern PocketVJ)
ecosystem on Raspbian x64 Lite.

- Interactive whiptail UI for Hostname, SSID, and WiFi Password configuration.
- Automated system hardening: hostapd, dnsmasq, avahi-daemon, and Node.js.
- Memory safety for Pi 3B: temporary 1GB swap and NPM concurrency limits.
- Networking failsafe: static AP on wlan0 and DHCP on eth0 with mDNS support.
- OpenSpec artifacts (Proposal, Design, Spec, Tasks) included.

openspec/changes/mpvj-headless-setup-script/specs/headless-installer/spec.md

@@ -0,0 +1,53 @@
+# Headless Installer Spec
+
+## Interrogation Phase
+
+### Hostname Selection
+- **GIVEN** the script is running
+- **WHEN** prompted for a hostname
+- **THEN** the system SHALL validate that the name contains only alphanumeric characters and hyphens
+- **AND** it SHALL default to `mpvj` if left blank
+
+### WiFi Configuration
+- **GIVEN** the interrogation phase
+- **WHEN** the user enters a WiFi password
+- **THEN** the script SHALL verify it is at least 8 characters long (WPA2 requirement)
+- **AND** it SHALL loop back to the prompt if validation fails
+- **AND** the script SHALL prompt for a 2-letter ISO Country Code (e.g., US, GB) to unblock the WiFi hardware.
+
+## Installation Phase
+
+### Pre-Flight Checks
+- **GIVEN** the start of the installation
+- **WHEN** checking system resources
+- **THEN** the script SHALL verify that at least 2GB of disk space is available
+- **AND** it SHALL abort with a clear error message if space is insufficient.
+
+### System Updates
+- **GIVEN** the start of the script
+- **WHEN** updating packages
+- **THEN** it SHALL use a progress bar (`whiptail --gauge`) to show status
+- **AND** it SHALL run in non-interactive mode (`-y`)
+
+### Repository Cloning
+- **GIVEN** a valid <REPO_URL> argument
+- **WHEN** cloning the repository
+- **THEN** it SHALL clone into `/home/pi/mpvj`
+- **AND** it SHALL ensure the `pi` user owns the directory
+
+## Summary & Finalization
+
+### Information Display
+- **GIVEN** the end of the installation
+- **WHEN** all configurations are staged
+- **THEN** the script SHALL display a "Don't Miss It" summary box containing:
+  - Hostname (`.local` address)
+  - Static IP (`192.168.4.1`)
+  - WiFi SSID
+  - WiFi Password
+- **AND** it SHALL require the user to press "OK" to proceed to the reboot prompt
+
+### Reboot Confirmation
+- **GIVEN** the summary has been acknowledged
+- **WHEN** the reboot prompt appears
+- **THEN** the system SHALL ONLY reboot if the user selects "Yes"