build: make deb pulls UI build via bun, drop stale angie comment

* Makefile: ui target prefers bun (with npm fallback) so make deb
  end-to-end reproduces a fresh dist/. deb-amd64/deb-arm64 now
  depend on ui, otherwise stale (or missing) management-ui/dist
  goes into edgeguard-ui.deb.
* deploy/systemd/edgeguard-api.service: stale "angie" reference
  in hardening comment removed.

Verified locally: make deb-amd64 produces three packages —
edgeguard-api_<v>_amd64.deb (6.9 MB), edgeguard-ui_<v>_all.deb
(320 KB), edgeguard_<v>_all.deb (4 KB meta). dpkg-deb -c
confirms layout matches packaging spec (binaries in /usr/bin,
units in /etc/systemd/system, UI under /usr/share/edgeguard/ui).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/systemd/edgeguard-api.service

@@ -13,7 +13,7 @@ ExecStart=/usr/bin/edgeguard-api
 Restart=on-failure
 RestartSec=5
 
-# Hardening — API needs to shell out to `sudo systemctl reload haproxy/angie/squid`
+# Hardening — API needs to shell out to `sudo systemctl reload haproxy/squid`
 # after writing configs. Sandboxing stays strict around fs/net.
 NoNewPrivileges=false
 ProtectSystem=strict