Add Debian/Ubuntu .deb packaging and update README

Debian packaging via cargo-deb:
- Add [package.metadata.deb] to Cargo.toml with assets, dependencies,
  and conffiles declarations
- Maintainer scripts: postinst (create fips group, enable services,
  restart on upgrade), prerm (stop/disable on remove, stop-only on
  upgrade), postrm (purge config, keys, group)
- Systemd units (fips.service, fips-dns.service) with /usr/bin/ paths
  for .deb installs
- tmpfiles.d entry for /run/fips/ runtime directory
- build-deb.sh wrapper script for building packages

README rewrite:
- Replace run-from-source Quick Start with Building section
- Add Installation options: Debian .deb (cargo-deb) and generic Linux
  (systemd tarball)
- Add full Configuration reference with default fips.yaml
- Add Usage sections: DNS resolution, monitoring (fipsctl + fipstop),
  service management, and testing
- Update project structure and features list

packaging/debian/fips.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=FIPS Mesh Network Daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/fips --config /etc/fips/fips.yaml
+Restart=on-failure
+RestartSec=5
+
+# Logging: RUST_LOG controls verbosity.
+# Use "info" for production, "debug" for troubleshooting.
+Environment=RUST_LOG=info
+
+# Control socket directory (/run/fips/).
+# Group-readable so 'fips' group members can use fipsctl/fipstop.
+RuntimeDirectory=fips
+RuntimeDirectoryMode=0750
+
+# Security hardening (daemon runs as root for TUN and raw sockets)
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=no
+
+[Install]
+WantedBy=multi-user.target