feat: apt-based deployment via Gitea Debian registry

Deklarix now ships as a .deb package instead of a raw binary, matching
the enconf-webpanel infrastructure standard: scripts/build.sh assembles
a real .deb (systemd unit, env template, postinst/prerm), scripts/release.sh
uploads it to Gitea's built-in Debian package registry after a green
test run. Target servers add one apt source and get updates via
`apt upgrade` from then on.

postinst only starts the service once DATABASE_URL is actually set in
/etc/deklarix/deklarix.env — the shipped template ships it commented out
on purpose, since an uncommented but unfilled placeholder URL is
syntactically indistinguishable from a real one and caused exactly that
crash-loop during verification.

Verified end-to-end against the real test server and Gitea registry:
upload -> apt-get update -> apt-cache policy -> apt-get install -> a
service that stays down until configured, then runs migrations and
serves /health once a real database is set.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packaging/DEBIAN/control.tmpl

@@ -2,6 +2,10 @@ Package: deklarix
 Version: VERSION
 Architecture: ARCH
 Maintainer: NetCell IT <team@netcell-it.de>
-Description: Deklarix — deklarix.de / deklarix.com
- Deklarix Software Package.
-Depends: 
+Homepage: https://deklarix.de
+Section: web
+Priority: optional
+Depends: ca-certificates
+Description: Deklarix — Prüfung und Nachweis für Werbe-Content
+ Pre-Publish-Kennzeichnungsprüfung und revisionssichere Archivierung
+ veröffentlichter Beiträge für Creator, Agenturen, Marken und Kanzleien.