build: make deb pulls UI build via bun, drop stale angie comment

* Makefile: ui target prefers bun (with npm fallback) so make deb
  end-to-end reproduces a fresh dist/. deb-amd64/deb-arm64 now
  depend on ui, otherwise stale (or missing) management-ui/dist
  goes into edgeguard-ui.deb.
* deploy/systemd/edgeguard-api.service: stale "angie" reference
  in hardening comment removed.

Verified locally: make deb-amd64 produces three packages —
edgeguard-api_<v>_amd64.deb (6.9 MB), edgeguard-ui_<v>_all.deb
(320 KB), edgeguard_<v>_all.deb (4 KB meta). dpkg-deb -c
confirms layout matches packaging spec (binaries in /usr/bin,
units in /etc/systemd/system, UI under /usr/share/edgeguard/ui).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Makefile

@@ -70,12 +70,14 @@ tidy:
 
 ui:
 	@echo "  -> management-ui (vite build, version $(VERSION))"
-	@cd management-ui && npm run build
+	@cd management-ui && \
+	    if [ -x "$$(command -v bun)" ]; then bun install --silent && bun run build; \
+	    else npm install --silent && npm run build; fi
 
-deb-amd64: build-linux-amd64
+deb-amd64: build-linux-amd64 ui
 	@./scripts/apt-repo/build-package.sh amd64 $(VERSION)
 
-deb-arm64: build-linux-arm64
+deb-arm64: build-linux-arm64 ui
 	@./scripts/apt-repo/build-package.sh arm64 $(VERSION)
 
 deb: deb-amd64 deb-arm64