feat(deploy): (d) end-to-end .deb install on 89.163.205.6 grün

Box (Debian 13 Trixie, amd64): apt install ./edgeguard-{api,ui,meta}.deb
zieht postgresql-17, haproxy 3.0, certbot, openssl, etc. nach.
postinst flow läuft sauber: migrate check → initdb → migrate up
(8 migrations) → render-config → install HAProxy drop-in → restart
haproxy → enable api+scheduler. Self-register in ha_nodes nach
Setup-Wizard funktioniert.

End-to-end smoke gegen 89.163.205.6:
* :80  → 301 Moved Permanently → https://
* :443 → TLS termination (self-signed _default.pem aus postinst)
        → JSON envelope vom api_backend (HTTP/2 + HSTS)
* /    → React index.html aus /usr/share/edgeguard/ui/

Änderungen:
* control: keydb-server von Depends nach Recommends — single-node v1
  installiert ohne KeyDB. Phase-3.1 multi-node bringt es zurück nach
  Depends sobald ein eigenes APT-Repo das Paket bereitstellt.
* postinst: render-config (--no-reload) + HAProxy-Drop-in installen +
  systemctl restart haproxy als zusätzliche Schritte.
* postrm: drop-in auf remove + purge entfernen, daemon-reload, ggf.
  haproxy auf distro-default zurückreloaden.
* deploy/systemd/haproxy-edgeguard.conf: Drop-in lenkt HAProxy-Unit
  auf /etc/edgeguard/haproxy/haproxy.cfg statt /etc/haproxy/haproxy.cfg.
  After=edgeguard-api.service vermeidet 503-Race in den ersten 5s.
* scripts/apt-repo/build-package.sh: shippt Drop-in unter
  /etc/edgeguard/systemd/haproxy-edgeguard.conf in der edgeguard-api.deb.
* haproxy.cfg.tpl: http-request redirect vor use_backend → keine
  HAProxy-Warning beim Parsen mehr.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packaging/debian/edgeguard-api/DEBIAN/control

@@ -12,8 +12,8 @@ Description: EdgeGuard — native Reverse-Proxy / LB / Forward-Proxy / VPN / Fir
  PG Streaming Replication + provider Floating-IP for HTTP ingress).
  .
  This package ships the management API, scheduler and CLI.
-Depends: postgresql-16 | postgresql-17, edgeguard-keydb (>= 6.3.4-edgeguard1), haproxy (>= 2.8), squid, wireguard-tools, unbound, nftables, certbot, openssl, sudo, adduser, systemd, ca-certificates
-Recommends: apparmor, fail2ban
+Depends: postgresql-16 | postgresql-17, haproxy (>= 2.8), squid, wireguard-tools, unbound, nftables, certbot, openssl, sudo, adduser, systemd, ca-certificates
+Recommends: edgeguard-keydb (>= 6.3.4-edgeguard1), apparmor, fail2ban
 Section: admin
 Priority: optional
 Installed-Size: 0

packaging/debian/edgeguard-api/DEBIAN/postinst

@@ -73,8 +73,29 @@ case "$1" in
             exit 1
         fi
 
-        # ── systemd ──────────────────────────────────────────────────
+        # ── Render initial service configs ───────────────────────────
+        # Writes /etc/edgeguard/haproxy/haproxy.cfg + nftables.d/
+        # ruleset.nft from the (just-migrated, empty) PG state.
+        # --no-reload because haproxy isn't pointed at our config yet
+        # — the drop-in below does that, then we restart.
+        if ! sudo -n -u "$EG_USER" /usr/bin/edgeguard-ctl render-config --no-reload; then
+            echo "postinst: edgeguard-ctl render-config failed — aborting" >&2
+            exit 1
+        fi
+
+        # ── HAProxy systemd drop-in: read EdgeGuard config ───────────
+        # Keeps the distro /etc/haproxy/haproxy.cfg untouched (it's a
+        # conffile of the haproxy package). Drop-in is reversible by
+        # removing the file + daemon-reload.
+        install -d /etc/systemd/system/haproxy.service.d
+        if [ -f /etc/edgeguard/systemd/haproxy-edgeguard.conf ]; then
+            install -m 0644 /etc/edgeguard/systemd/haproxy-edgeguard.conf \
+                            /etc/systemd/system/haproxy.service.d/edgeguard.conf
+        fi
+
+        # ── systemd: pick up new units + restart haproxy with our cfg
         systemctl daemon-reload
+        systemctl restart haproxy.service || true
         systemctl enable --now edgeguard-api.service edgeguard-scheduler.service || true
         ;;
 

packaging/debian/edgeguard-api/DEBIAN/postrm

@@ -3,14 +3,28 @@ set -e
 
 case "$1" in
     purge)
-        # Only on purge: remove user, configs, state.
+        # Only on purge: remove user, configs, state, HAProxy
+        # drop-in (so the distro haproxy.cfg path takes over again).
         if getent passwd edgeguard >/dev/null; then
             deluser --quiet edgeguard >/dev/null 2>&1 || true
         fi
+        rm -f /etc/systemd/system/haproxy.service.d/edgeguard.conf
+        rmdir /etc/systemd/system/haproxy.service.d 2>/dev/null || true
+        systemctl daemon-reload || true
         rm -rf /etc/edgeguard /var/lib/edgeguard /var/log/edgeguard
         ;;
 
-    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    remove)
+        # Plain remove (not purge) — pull our HAProxy override so
+        # the haproxy daemon goes back to its distro config and
+        # keeps running.
+        rm -f /etc/systemd/system/haproxy.service.d/edgeguard.conf
+        rmdir /etc/systemd/system/haproxy.service.d 2>/dev/null || true
+        systemctl daemon-reload || true
+        systemctl reload haproxy.service 2>/dev/null || true
+        ;;
+
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
         ;;
 
     *)