feat(bin): add collect_debug.sh for debugging faulty installations - #3077

Issues Fixed

Not associated with a specific issue. Adds a self-contained diagnostics collector so users reporting a broken install (and maintainers triaging on the forum / GitHub) can attach one redacted archive instead of being walked through a dozen manual commands.

Description

Adds bin/collect_debug.sh — a read-only diagnostics collector that bundles everything needed to debug a faulty Anthias install into a single, shareable .tar.gz. It is safe to run on a live device and never touches the running stack.

Collected into one report:

• System / hardware — OS, kernel, arch, memory, disk + inode usage, top RAM consumers, mounts.
• Raspberry Pi specifics — model, throttling (vcgencmd get_throttled), temperature, firmware, config.txt.
• Docker / compose — versions, all containers, images, volumes, compose ps, resolved compose config, live stats.
• Container inspect — restart counts, OOMKilled, exit codes, errors (the usual crash-loop culprits).
• Logs — per-container (server/viewer/celery/redis/caddy), Docker daemon, and dmesg. Tries compose logs, then journald-by-tag (production driver), then docker logs.
• Config / DB — anthias.conf with secrets blanked, DB integrity check, journal mode, asset counts/inventory, assets dir size.
• Video assets — enumerated straight from the live ORM and probed with ffprobe inside the server/celery image (mirroring processing.py), so "video won't play" reports arrive with codec/container detail and no host ffmpeg dependency.
• Network / Redis — interfaces, routes, DNS, listening sockets, local UI + internet reachability, Redis PING/INFO.

A final pass redacts PII from every file before archiving — IP/MAC addresses, emails, URL-embedded credentials, the device hostname, and anthias.conf secrets — while preserving non-identifying constants (127.0.0.1, 0.0.0.0) so bind/route lines stay readable. The IPv6 rule requires ≥5 hex groups so it can't eat log timestamps.

Usage: bin/collect_debug.sh [--output DIR] [--lines N] [--no-archive]

Validated end-to-end on the x86 testbed (full integrated stack, all 4 containers up): seeded a temporary video asset, ran the script on-device, confirmed ffprobe returned clean JSON via the live ORM enumeration, and verified the device's real IP/MAC/hostname were fully redacted (0 leaks) while loopback constants were preserved. All test artifacts were removed afterward.

Checklist

• I have performed a self-review of my own code.
• New and existing unit tests pass locally and on CI with my changes. (Shell script; no unit tests added. Linted with shellcheck and bash -n.)
• I have done an end-to-end test for Raspberry Pi devices. (Not yet run on a Pi; logic is host-agnostic.)
• I have tested my changes for x86 devices.
• I added a documentation for the changes I have made (when necessary).

🤖 Generated with Claude Code