feat(waf): Phase 4 — Packaging, CRS, systemd, sudoers — v1.2.69

- Makefile: edgeguard-waf zu BINARIES hinzugefügt
- deploy/systemd/edgeguard-waf.service: systemd-Unit (User=edgeguard,
  After=postgresql + edgeguard-api, Hardening, ReadWritePaths=/var/log/edgeguard)
- build-package.sh: edgeguard-waf Binary + Service ins .deb
- postinst: OWASP CRS v4.7.0 Download bei Erstinstall nach
  /usr/share/edgeguard/waf/crs/; graceful wenn kein Internet vorhanden
- postinst: edgeguard-waf.service enable + start bei install/upgrade
- postinst: sudoers für start/stop/enable/disable/restart edgeguard-waf.service
- system.go: edgeguard-waf in servicesToCheck + toggleAllowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/apt-repo/build-package.sh

@@ -61,7 +61,7 @@ build_api() {
     [ -f "$pkg_src/DEBIAN/conffiles" ] && cp "$pkg_src/DEBIAN/conffiles" "$build_dir/DEBIAN/"
 
     # binaries
-    for bin in edgeguard-api edgeguard-scheduler edgeguard-ctl; do
+    for bin in edgeguard-api edgeguard-scheduler edgeguard-ctl edgeguard-waf; do
         install -m 0755 "$REPO_ROOT/build/$ARCH/$bin" "$build_dir/usr/bin/$bin"
     done
 
@@ -70,6 +70,8 @@ build_api() {
                     "$build_dir/etc/systemd/system/"
     install -m 0644 "$REPO_ROOT/deploy/systemd/edgeguard-scheduler.service" \
                     "$build_dir/etc/systemd/system/"
+    install -m 0644 "$REPO_ROOT/deploy/systemd/edgeguard-waf.service" \
+                    "$build_dir/etc/systemd/system/"
 
     # systemd drop-in for HAProxy — postinst copies it into
     # /etc/systemd/system/haproxy.service.d/. Shipped under