chore: initial skeleton

- docs/architecture.md: native rewrite plan (5 services + control plane,
  Active-Active cluster like nmg, Floating-IP for HTTP ingress)
- cmd/edgeguard-{api,scheduler,ctl}: minimal Gin + CLI stubs
- packaging/debian/edgeguard-{api,ui,meta}: control + maintainer scripts
- deploy/systemd/edgeguard-api.service + edgeguard-scheduler.service
  with hardening defaults
- Makefile: build / cross-compile (amd64+arm64) / deb / publish targets
- scripts/install.sh + scripts/apt-repo/build-package.sh stubs

README.md

@@ -0,0 +1,35 @@
+# EdgeGuard
+
+Native Reverse-Proxy / Loadbalancer / Forward-Proxy / VPN / Firewall — als signiertes `.deb` für Debian 13 + Ubuntu 24.04, amd64 + arm64.
+
+> Status: **v0.x — Neufassung des bisherigen Docker-Stacks**, parallel zum Bestand `proxy-lb-waf`.
+
+## Installation
+
+```
+curl -fsSL https://get.edgeguard.netcell-it.de | sudo bash
+```
+
+**Unterstützte Plattformen:** Debian 13 (Trixie), Ubuntu 24.04 LTS (Noble) — amd64 + arm64.
+
+## Architektur in Kürze
+
+- **Daten-Services (v1):** HAProxy, Angie, Squid, WireGuard, nftables — alle nativ via APT, Configs aus PostgreSQL generiert.
+- **Control-Plane:** `edgeguard-api` (Go/Gin), `management-ui` (React/AntD), PostgreSQL 16, KeyDB Active-Active.
+- **Cluster:** N symmetrische Peers, KeyDB AA für Shared State, PG Streaming Replication, Floating-IP des Hosters statt VRRP.
+- **Auslieferung:** signierte `.deb`, Update via `apt`. Update-Trigger via UI/API.
+
+Volle Architektur: [`docs/architecture.md`](docs/architecture.md).
+
+## Build
+
+```
+make build       # Host-Architektur
+make deb         # amd64 + arm64 .deb
+make publish     # deb + Upload Gitea Package Registry
+```
+
+## Repo
+
+- **Lokal:** `/var/www/edgeguard-native`
+- **Gitea:** `https://git.netcell-it.de/projekte/edgeguard-native`