docs(cluster): document bastion and recovery operations

docs-site/docs/getting-started/installation.md

@@ -48,8 +48,9 @@ Images: [`awuqing/backupx`](https://hub.docker.com/r/awuqing/backupx) — suppor
 Download from the [Releases page](https://github.com/Awuqing/BackupX/releases) and run the installer:
 
 ```bash
+sha256sum -c backupx-v*-linux-amd64.tar.gz.sha256
 tar xzf backupx-v*-linux-amd64.tar.gz && cd backupx-*
-sudo ./install.sh        # creates system user, installs to /opt/backupx, sets up systemd + nginx
+sudo ./install.sh        # creates system user, installs to /opt/backupx, sets up systemd
 ```
 
 The installer:
@@ -58,7 +59,7 @@ The installer:
 2. Installs the binary to `/opt/backupx/bin/backupx` and the web console to `/opt/backupx/web`
 3. Creates `/etc/backupx/config.yaml` with safe defaults
 4. Installs and enables the `backupx.service` systemd unit
-5. (Optional) Configures an Nginx reverse proxy
+5. Leaves Nginx unchanged unless `INSTALL_NGINX=1` is explicitly requested
 6. Waits for `/api/auth/setup/status`; if startup fails, prints systemd diagnostics and exits non-zero
 
 ## From source
@@ -74,6 +75,8 @@ sudo ./deploy/install.sh
 After `make build`, the binary is at `server/bin/backupx` and the built web UI is at `web/dist/`.
 The installer consumes those exact paths, so no Docker runtime is required. If an existing configuration uses a non-default port, set `HEALTH_URL` for the readiness check, for example `sudo HEALTH_URL=http://127.0.0.1:9000/api/auth/setup/status ./deploy/install.sh`.
 
+The Nginx template is opt-in because automatically installing a catch-all virtual host can intercept existing sites. Review `deploy/nginx.conf`, then use `sudo INSTALL_NGINX=1 ./deploy/install.sh` only when it matches the host.
+
 ## Verify the install
 
 ```bash