feat(waf): Phase 4 — Packaging, CRS, systemd, sudoers — v1.2.69

- Makefile: edgeguard-waf zu BINARIES hinzugefügt
- deploy/systemd/edgeguard-waf.service: systemd-Unit (User=edgeguard,
  After=postgresql + edgeguard-api, Hardening, ReadWritePaths=/var/log/edgeguard)
- build-package.sh: edgeguard-waf Binary + Service ins .deb
- postinst: OWASP CRS v4.7.0 Download bei Erstinstall nach
  /usr/share/edgeguard/waf/crs/; graceful wenn kein Internet vorhanden
- postinst: edgeguard-waf.service enable + start bei install/upgrade
- postinst: sudoers für start/stop/enable/disable/restart edgeguard-waf.service
- system.go: edgeguard-waf in servicesToCheck + toggleAllowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -165,6 +165,12 @@ edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli collections list -o json
 edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli collections install *
 edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli collections remove *
 edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli version
+# WAF agent service control
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl start edgeguard-waf.service
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl stop edgeguard-waf.service
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl enable edgeguard-waf.service
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl disable edgeguard-waf.service
+edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl restart edgeguard-waf.service
 # CrowdSec service toggle (start/stop/enable/disable)
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl start crowdsec.service
 edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl stop crowdsec.service
@@ -790,10 +796,38 @@ EOSQL
                             /etc/systemd/system/haproxy.service.d/edgeguard.conf
         fi
 
+        # ── OWASP Core Rule Set (CRS) für edgeguard-waf ─────────────────────
+        # Nur beim Erstinstall — kein Überschreiben bei Upgrades damit
+        # admins angepasste crs-setup.conf behalten können.
+        WAF_CRS_DIR="/usr/share/edgeguard/waf/crs"
+        if [ "$1" = "configure" ] && [ -z "$2" ] && [ ! -d "$WAF_CRS_DIR/rules" ]; then
+            CRS_VERSION="4.7.0"
+            echo "postinst: installing OWASP CRS v${CRS_VERSION}..."
+            install -d -m 0755 "$WAF_CRS_DIR/rules"
+            CRS_TMP="$(mktemp -d)"
+            if curl -sL --max-time 60 \
+                "https://github.com/coreruleset/coreruleset/archive/refs/tags/v${CRS_VERSION}.tar.gz" \
+                -o "${CRS_TMP}/crs.tar.gz" 2>/dev/null; then
+                tar xzf "${CRS_TMP}/crs.tar.gz" -C "${CRS_TMP}" 2>/dev/null || true
+                CRS_SRC="${CRS_TMP}/coreruleset-${CRS_VERSION}"
+                if [ -f "${CRS_SRC}/crs-setup.conf.example" ]; then
+                    install -m 0644 "${CRS_SRC}/crs-setup.conf.example" "${WAF_CRS_DIR}/crs-setup.conf"
+                    install -m 0644 "${CRS_SRC}/rules/"*.conf "${WAF_CRS_DIR}/rules/" 2>/dev/null || true
+                    chown -R "$EG_USER":"$EG_USER" "$WAF_CRS_DIR"
+                    echo "postinst: OWASP CRS v${CRS_VERSION} installed to ${WAF_CRS_DIR}"
+                else
+                    echo "postinst: CRS download succeeded but layout unexpected — skipping" >&2
+                fi
+            else
+                echo "postinst: CRS download failed (no internet?) — WAF usable without CRS" >&2
+            fi
+            rm -rf "${CRS_TMP}"
+        fi
+
         # ── systemd: pick up new units + restart haproxy with our cfg
         systemctl daemon-reload
         systemctl restart haproxy.service || true
-        systemctl enable edgeguard-api.service edgeguard-scheduler.service || true
+        systemctl enable edgeguard-api.service edgeguard-scheduler.service edgeguard-waf.service || true
         # restart (NICHT enable --now): das neue Unit-File könnte ein
         # geänderter ReadWritePaths-Block sein (Befund 1.0.87:
         # /var/lib/apt fehlte → apt-get update aus dem Update-Banner-
@@ -802,7 +836,7 @@ EOSQL
         # der laufende Daemon behält das alte Sandbox-Snapshot bis zum
         # restart. Bei Erst-Install ist nichts running, dann ist das
         # ein normaler Start.
-        systemctl restart edgeguard-api.service edgeguard-scheduler.service || true
+        systemctl restart edgeguard-api.service edgeguard-scheduler.service edgeguard-waf.service || true
 
         # WireGuard-Sicherung: enabled-aber-inaktive wg-quick@-Interfaces
         # nach dem API-Restart starten. Der API-Renderer kann wg-quick@