feat: apt-based deployment via Gitea Debian registry

Deklarix now ships as a .deb package instead of a raw binary, matching
the enconf-webpanel infrastructure standard: scripts/build.sh assembles
a real .deb (systemd unit, env template, postinst/prerm), scripts/release.sh
uploads it to Gitea's built-in Debian package registry after a green
test run. Target servers add one apt source and get updates via
`apt upgrade` from then on.

postinst only starts the service once DATABASE_URL is actually set in
/etc/deklarix/deklarix.env — the shipped template ships it commented out
on purpose, since an uncommented but unfilled placeholder URL is
syntactically indistinguishable from a real one and caused exactly that
crash-loop during verification.

Verified end-to-end against the real test server and Gitea registry:
upload -> apt-get update -> apt-cache policy -> apt-get install -> a
service that stays down until configured, then runs migrations and
serves /health once a real database is set.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/build.sh

@@ -1,23 +1,19 @@
 #!/usr/bin/env bash
-# Deklarix — Build-Skript (amd64 + arm64)
+# Deklarix — .deb-Pakete bauen (amd64 + arm64)
 #
 # Verwendung:
 #   ./scripts/build.sh [version]          # Beide Architekturen
 #   ./scripts/build.sh [version] amd64    # Nur amd64
 #   ./scripts/build.sh [version] arm64    # Nur arm64
 #
-# Ausgabe: dist/deklarix_<version>_<arch>
-#
-# Release-Prozess:
-#   1. VERSION erhöhen (Semantic Versioning: MAJOR.MINOR.PATCH)
-#   2. ./scripts/build.sh <version>
-#   3. ./scripts/test.sh
-#   4. git tag v<version> && git push origin v<version>
+# Ausgabe: dist/deklarix_<version>_<arch>.deb
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+PACKAGING_DIR="$REPO_DIR/packaging"
+BUILD_DIR="$REPO_DIR/dist/build"
 VERSION="${1:-0.0.1}"
 ARCH_FILTER="${2:-both}"
 
@@ -26,9 +22,8 @@ log() { echo -e "${GRN}[build]${NC} $*"; }
 
 export PATH=$PATH:/usr/local/go/bin
 
-command -v go >/dev/null || { echo "Go nicht gefunden — PATH: $PATH"; exit 1; }
-
-mkdir -p "$REPO_DIR/dist"
+command -v go       >/dev/null || { echo "Go nicht gefunden — PATH: $PATH"; exit 1; }
+command -v dpkg-deb >/dev/null || { echo "dpkg-deb nicht gefunden"; exit 1; }
 
 log "Version: $VERSION  |  Go: $(go version)"
 
@@ -39,14 +34,40 @@ case "$ARCH_FILTER" in
     *)     ARCHS=("amd64" "arm64") ;;
 esac
 
+rm -rf "$BUILD_DIR"
+mkdir -p "$REPO_DIR/dist"
+
 for ARCH in "${ARCHS[@]}"; do
-    OUT="$REPO_DIR/dist/deklarix_${VERSION}_${ARCH}"
-    log "Baue $ARCH → $OUT"
-    GOARCH=$ARCH GOOS=linux go build \
-        -ldflags="-X main.Version=${VERSION} -s -w" \
-        -o "$OUT" \
+    DEB_NAME="deklarix_${VERSION}_${ARCH}"
+    DEB_DIR="$BUILD_DIR/$DEB_NAME"
+
+    log "Baue Binary ($ARCH)..."
+    mkdir -p "$DEB_DIR/DEBIAN" \
+             "$DEB_DIR/usr/bin" \
+             "$DEB_DIR/etc/systemd/system" \
+             "$DEB_DIR/etc/deklarix"
+    CGO_ENABLED=0 GOARCH=$ARCH GOOS=linux go build \
+        -trimpath -ldflags="-X main.Version=${VERSION} -s -w" \
+        -o "$DEB_DIR/usr/bin/deklarix" \
         ./cmd/deklarix/
-    log "$ARCH fertig: $(du -sh "$OUT" | cut -f1)"
+    chmod 755 "$DEB_DIR/usr/bin/deklarix"
+
+    log "Stelle Paket zusammen ($ARCH)..."
+    sed "s/^Version: VERSION/Version: $VERSION/; s/^Architecture: ARCH/Architecture: $ARCH/" \
+        "$PACKAGING_DIR/DEBIAN/control.tmpl" > "$DEB_DIR/DEBIAN/control"
+    cp "$PACKAGING_DIR/DEBIAN/postinst"  "$DEB_DIR/DEBIAN/postinst"
+    cp "$PACKAGING_DIR/DEBIAN/prerm"     "$DEB_DIR/DEBIAN/prerm"
+    cp "$PACKAGING_DIR/DEBIAN/conffiles" "$DEB_DIR/DEBIAN/conffiles"
+    chmod 755 "$DEB_DIR/DEBIAN/postinst" "$DEB_DIR/DEBIAN/prerm"
+
+    cp "$PACKAGING_DIR/etc/systemd/system/deklarix.service" "$DEB_DIR/etc/systemd/system/"
+    cp "$PACKAGING_DIR/etc/deklarix/deklarix.env.example"   "$DEB_DIR/etc/deklarix/"
+
+    dpkg-deb --build --root-owner-group "$DEB_DIR" "$REPO_DIR/dist/$DEB_NAME.deb"
+
+    log "$ARCH fertig: dist/$DEB_NAME.deb ($(du -sh "$REPO_DIR/dist/$DEB_NAME.deb" | cut -f1))"
 done
 
+rm -rf "$BUILD_DIR"
+
 log "Build abgeschlossen ✓"