Polish settings, add matching defaults, drop pkg2zip, externalize infra config

- Rework Settings tab into grouped sections
- Add preferred-region matching and full-hash-by-default setting
- Replace combo-box square arrow with a proper chevron
- Fix UMD Refresh button (clicked bool was clearing the view)
- Remove pkg2zip.exe fallback (pure-Python decryptor is the primary path)
- Move LAN IP/share paths to .env; use example defaults in config

README.md

@@ -109,10 +109,6 @@ Discs are matched by hash first (most precise), then serial, then filename.
   to drawn art when they're absent.
 - `data/nps/` — NoPayStation TSV lists (cached here on first store scan in dev;
   a packaged build stores them under the state dir instead).
-- `data/bin/pkg2zip.exe` — bundled `pkg2zip` binary (MIT, by mmozeiko) kept
-  only as an optional fallback decryptor; the app normally uses its own
-  pure-Python decryptor (`app/pkg.py`) and never needs Wine.
-  See `data/bin/ATTRIBUTION.md`.
 - State dir (`~/.local/state/psp-preserve/` on Linux, `%LOCALAPPDATA%\PSPPreserve`
   on Windows, or `$PSP_STATE_DIR`):
   - `library.sqlite` — the catalog + library database.
@@ -141,7 +137,7 @@ QSettings under `PSPPreserve`) taking precedence where noted.
 | `PSP_PS1_ROOTS` | `/data/ps1` | comma-separated PS1 disc roots |
 | `PSP_PS1_OUTPUT_DIR` | `/data/ps1_converted` | converted EBOOT.PBP output folder |
 | `PSP_SCAN_WORKERS` | `1` | parallel hashing workers |
-| `PSP_STORE_DIR` | `/media/downloads/Sony - PlayStation Portable` | local 7z store folder |
+| `PSP_STORE_DIR` | `/data/store` | local 7z store folder |
 | `PSP_STORE_SERVER` | `https://psp.example.com` | store server base URL |
 | `PSP_STORE_TOKEN` | *(empty)* | store server bearer token |
 | `PSP_ARCHIVE_ITEM` | `psp-redump-roms321.com` | archive.org item identifier |
@@ -149,7 +145,6 @@ QSettings under `PSPPreserve`) taking precedence where noted.
 | `PSP_ARCHIVE_LOGGED_IN_USER` | *(empty)* | archive.org `logged-in-user` cookie |
 | `PSP_NPS_DIR` | `<state>/nps` | NoPayStation output folder |
 | `PSP_NPS_TSV_BASE` | `https://nopaystation.com/tsv/` | NoPayStation TSV base URL |
-| `PSP_PKG2ZIP_PATH` | *(empty)* | pkg2zip binary path (else auto-detected) |
 | `PSP_API_TOKEN` | *(empty)* | server API bearer token (unset = open) |
 | `PSP_USER_DATA_DIR` | `<state>/data` (packaged) / `./data` (dev) | user-writable data (credentials, manual covers, PS1 templates, NPS cache) |
 | `PSP_CREDENTIALS` | `$PSP_USER_DATA_DIR/credentials.json` | credentials file |
@@ -293,8 +288,7 @@ Requirements & behaviour:
 
 1. `.pkg` files are decrypted by the built-in **pure-Python decryptor**
    (`app/pkg.py`, powered by `pycryptodome` for speed) — no Wine and no
-   `pkg2zip` install needed. A bundled `pkg2zip.exe` is kept as a fallback
-   only, and only runs if Python decryption fails and Wine is present.
+   `pkg2zip` needed.
 2. Set **NoPayStation output dir** in **Settings → Store** (default
    `$PSP_STATE_DIR/nps`).
 3. Downloads land in the NPS folder and appear in the **Library**:
@@ -360,13 +354,14 @@ Token protection: set `PSP_API_TOKEN`; the client sends
 macvlan bridge so it gets its own LAN IP (e.g. `192.168.1.100`, plain HTTP on 8000):
 
 ```bash
-# in /path/to/psp-preserve/ — adjust the volume paths for your shares
-printf 'PSP_API_TOKEN=<long-random-secret>\n' > .env
+# in /path/to/psp-preserve/
+cp .env.example .env   # then edit: LAN IP, share paths, API token
 docker compose up -d --build
 ```
 
-The compose file mounts your Unraid shares into `/data/store`, `/data/umd_games`
-and `/data/umd_videos` (the store is mounted read-only).
+The compose file reads the LAN IP and Unraid share paths from `.env` and
+mounts them into `/data/store`, `/data/umd_games` and `/data/umd_videos`
+(the store is mounted read-only).
 
 ### TLS (optional)