Serve the Pi's web UI on port 80 instead of 8080

Just http://<pi-ip> now instead of http://<pi-ip>:8080. Safe since
the systemd service already runs as root (needed for GPIO/SPI access
anyway), so binding the privileged port isn't a new requirement.

Local --mock dev stays on 8080 (README/main.py default unchanged) --
that's normally run without root, and port 80 needs it.

install.sh now does enable + restart instead of enable --now, so
re-running it after a unit-file change (like this one) actually
applies on an already-installed instance, not just a fresh install.

paperwall.service.template

@@ -6,7 +6,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 # Filled in by install.sh to point at this project's own self-contained venv.
-ExecStart={{PYTHON}} {{APP_DIR}}/main.py --host 0.0.0.0 --port 8080
+ExecStart={{PYTHON}} {{APP_DIR}}/main.py --host 0.0.0.0 --port 80
 WorkingDirectory={{APP_DIR}}
 Restart=on-failure
 RestartSec=5