Add missing cancel option to 15 more multi-instance services; add setup.sh --status

Same bug as the previous filebrowser/fmd fix: vaultwarden, immich,
audiobookshelf, homebox, rustdesk, emby, meshcentral, traccar, lyrion,
actualbudget, mealie, joplin, jellyfin, unifi, and ntfy all showed "Manage
that install (update / full reinstall / cancel)" when re-run against an
existing install, but choosing "1) Manage" fell straight through into the
same unconditional fresh-install flow every time regardless of choice —
no way to actually cancel or update in place. Wired all 15 up to
prompt_reinstall_mode, matching the reference pattern in
services/mattermost.sh: update pulls + restarts the existing container
without touching config, cancel leaves the install untouched, fresh falls
through to the existing full-install flow unchanged.

Also add `setup.sh --status`: a plain-text listing of every service with
its install state, using the exact same is_installed() calls the whiptail
checklist's [installed] marker uses. Exists so "is X actually installed"
can be answered by reading terminal output directly, without depending on
a whiptail checklist screen where a narrow/resized terminal can truncate
the "[installed]" suffix off-screen with no visible sign that happened.

setup.sh

@@ -6,6 +6,7 @@
 #                                   category menu you loop through
 #   sudo ./setup.sh <service> ...   install one or more services directly
 #   ./setup.sh --list               list available services (grouped)
+#   ./setup.sh --status             list services with install status (no whiptail)
 #   ./setup.sh --version            print version
 #
 # Flags:
@@ -33,13 +34,14 @@ declare -A SERVICE_PRIORITY=( [caddy]=1 [crowdsec]=2 [authelia]=3 )
 declare -A SERVICE_ALIAS=( [asterisk-digital-ocean]=asterisk )
 
 # ── Parse flags / collect service names ──────────────────────────────────────
-DRY_RUN=false; UNATTENDED=false; DO_LIST=false
+DRY_RUN=false; UNATTENDED=false; DO_LIST=false; DO_STATUS=false
 REQUESTED=()
 for arg in "$@"; do
     case "$arg" in
         --dry-run)    DRY_RUN=true ;;
         --unattended) UNATTENDED=true ;;
         --list|-l)    DO_LIST=true ;;
+        --status)     DO_STATUS=true ;;
         --version|-V) cat "$HERE/VERSION" 2>/dev/null || echo "unknown"; exit 0 ;;
         -h|--help)    sed -n '2,18p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
         -*) echo "Unknown flag: $arg" >&2; exit 1 ;;
@@ -130,6 +132,25 @@ list_services() {
     echo ""
 }
 
+# Plain-text version of the whiptail checklist's [installed] marker — same
+# is_installed() calls, no whiptail involved. Exists so "is X actually
+# installed" can be answered by reading terminal output directly instead of
+# a checklist screen, where a narrow/resized terminal can truncate or wrap
+# the "[installed]" suffix off-screen without it being obvious that's what
+# happened.
+print_status() {
+    local g name marker
+    while IFS= read -r g; do
+        echo ""; echo "── ${g^^} ──"
+        while IFS= read -r name; do
+            marker="not installed"
+            is_installed "$name" && marker="INSTALLED"
+            printf "  %-20s %-12s %s\n" "$name" "$marker" "${SERVICE_DESC[$name]}"
+        done < <(services_in_group "$g")
+    done < <(groups_present)
+    echo ""
+}
+
 # ── Site defaults wizard ──────────────────────────────────────────────────────
 # Prompts for timezone, base domain, and Caddy network name; saves to .config.
 # Run directly:  sudo ./setup.sh configure
@@ -206,6 +227,9 @@ run_site_configure() {
 # ── --list ───────────────────────────────────────────────────────────────────
 if [ "$DO_LIST" = true ]; then list_services; exit 0; fi
 
+# ── --status ─────────────────────────────────────────────────────────────────
+if [ "$DO_STATUS" = true ]; then print_status; exit 0; fi
+
 # ── configure: show/update site-wide defaults ────────────────────────────────
 if [ "${REQUESTED[*]:-}" = "configure" ]; then
     require_root