chore: initial skeleton

- docs/architecture.md: native rewrite plan (5 services + control plane,
  Active-Active cluster like nmg, Floating-IP for HTTP ingress)
- cmd/edgeguard-{api,scheduler,ctl}: minimal Gin + CLI stubs
- packaging/debian/edgeguard-{api,ui,meta}: control + maintainer scripts
- deploy/systemd/edgeguard-api.service + edgeguard-scheduler.service
  with hardening defaults
- Makefile: build / cross-compile (amd64+arm64) / deb / publish targets
- scripts/install.sh + scripts/apt-repo/build-package.sh stubs

Makefile

@@ -0,0 +1,104 @@
+# EdgeGuard — Build-System.
+# Cross-Compile für Debian 13 + Ubuntu 24.04 auf amd64 und arm64.
+# CGO_ENABLED=0 (statische Binaries, keine libre2-/CGO-Abhängigkeit in v1).
+
+GO       ?= $(shell which go || echo /usr/local/go/bin/go)
+MODULE   := git.netcell-it.de/projekte/edgeguard-native
+BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl
+VERSION  := $(shell cat VERSION 2>/dev/null || echo 0.0.1-dev)
+LDFLAGS  := -s -w -X main.version=$(VERSION)
+GOFLAGS  := -trimpath -mod=readonly
+export CGO_ENABLED ?= 0
+
+.PHONY: all help build test lint tidy clean ui \
+        build-linux-amd64 build-linux-arm64 \
+        deb deb-amd64 deb-arm64 \
+        publish publish-amd64 publish-arm64
+
+all: build
+
+help:
+	@echo "EdgeGuard build targets:"
+	@echo "  build              Build all binaries for the host architecture (build/host/)"
+	@echo "  build-linux-amd64  Cross-compile all binaries for linux/amd64 (build/amd64/)"
+	@echo "  build-linux-arm64  Cross-compile all binaries for linux/arm64 (build/arm64/)"
+	@echo "  test               go test ./..."
+	@echo "  lint               go vet + staticcheck (if installed)"
+	@echo "  tidy               go mod tidy"
+	@echo "  ui                 Build management-ui (vite)"
+	@echo "  deb-amd64          Cross-compile + build edgeguard_<ver>_amd64.deb"
+	@echo "  deb-arm64          Cross-compile + build edgeguard_<ver>_arm64.deb"
+	@echo "  deb                Build both amd64 and arm64 .deb packages"
+	@echo "  publish-amd64      Build amd64 deb AND upload to Gitea"
+	@echo "  publish-arm64      Same for arm64"
+	@echo "  publish            publish-amd64 + publish-arm64"
+	@echo "  clean              Remove build artifacts"
+
+build:
+	@mkdir -p build/host
+	@for bin in $(BINARIES); do \
+	    echo "  -> build/host/$$bin"; \
+	    $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
+	        -o build/host/$$bin ./cmd/$$bin || exit 1; \
+	done
+
+build-linux-amd64:
+	@mkdir -p build/amd64
+	@for bin in $(BINARIES); do \
+	    echo "  -> build/amd64/$$bin"; \
+	    GOOS=linux GOARCH=amd64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
+	        -o build/amd64/$$bin ./cmd/$$bin || exit 1; \
+	done
+
+build-linux-arm64:
+	@mkdir -p build/arm64
+	@for bin in $(BINARIES); do \
+	    echo "  -> build/arm64/$$bin"; \
+	    GOOS=linux GOARCH=arm64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
+	        -o build/arm64/$$bin ./cmd/$$bin || exit 1; \
+	done
+
+test:
+	$(GO) test $(GOFLAGS) ./...
+
+lint:
+	$(GO) vet ./...
+	@command -v staticcheck >/dev/null && staticcheck ./... || echo "staticcheck not installed, skipping"
+
+tidy:
+	$(GO) mod tidy
+
+ui:
+	@echo "  -> management-ui (vite build, version $(VERSION))"
+	@cd management-ui && npm run build
+
+deb-amd64: build-linux-amd64
+	@./scripts/apt-repo/build-package.sh amd64 $(VERSION)
+
+deb-arm64: build-linux-arm64
+	@./scripts/apt-repo/build-package.sh arm64 $(VERSION)
+
+deb: deb-amd64 deb-arm64
+
+GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload
+
+publish-amd64: deb-amd64
+	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
+	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
+	echo "  -> publish edgeguard-api_$(VERSION)_amd64.deb"; \
+	curl -sS -H "Authorization: token $$TOK" \
+	    --upload-file build/deb/edgeguard-api_$(VERSION)_amd64.deb \
+	    $(GITEA_DEB_URL)
+
+publish-arm64: deb-arm64
+	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
+	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
+	echo "  -> publish edgeguard-api_$(VERSION)_arm64.deb"; \
+	curl -sS -H "Authorization: token $$TOK" \
+	    --upload-file build/deb/edgeguard-api_$(VERSION)_arm64.deb \
+	    $(GITEA_DEB_URL)
+
+publish: publish-amd64 publish-arm64
+
+clean:
+	rm -rf build/