Add Windows platform support (#45)

Gate platform-specific code behind cfg attributes and add full Windows
  support: TUN device via wintun, TCP control socket on localhost:21210,
  Windows Service lifecycle (--install-service/--uninstall-service/--service),
  CI build and test matrix, and packaging with ZIP builder and PowerShell
  service management scripts.

  Key changes:

  - Cargo.toml: move tun/libc/rtnetlink behind cfg(unix); add wintun and
    windows-service dependencies for Windows
  - upper/tun.rs: wintun-based TUN implementation with netsh configuration
    for IPv6 address, MTU, and fd00::/8 routing
  - control/mod.rs: split into unix_impl/windows_impl; Windows uses TCP on
    localhost:21210 with shared connection handler
  - bin/fips.rs: refactor main() into run_daemon() accepting a shutdown
    signal; add Windows Service support via windows-service crate
  - transport/udp/socket.rs: platform-gated modules; Windows uses
    tokio::net::UdpSocket (kernel drop count unavailable, returns 0)
  - transport/ethernet: gate to cfg(unix); add Windows stub types
  - config: platform-conditional default paths (socket, hosts) for Windows
  - CI: add windows-latest to build matrix and test-windows job with
    cargo-nextest
  - packaging/windows: build-zip.ps1, install-service.ps1,
    uninstall-service.ps1, and package-windows.yml workflow
  - README/docs: Windows build instructions, service management, and
    control socket platform differences

  Linux and macOS behavior is unchanged.

packaging/README.md

@@ -11,6 +11,7 @@ make tarball    # systemd install tarball
 make ipk        # OpenWrt .ipk
 make aur        # Arch Linux AUR package (fips-git, local build + namcap)
 make pkg        # macOS .pkg installer
+make zip        # Windows .zip package
 make all        # deb + tarball (default)
 ```
 
@@ -24,6 +25,7 @@ packaging/
   macos/          macOS .pkg installer via pkgbuild
   systemd/        Generic Linux systemd tarball packaging
   openwrt/        OpenWrt .ipk packaging via cargo-zigbuild
+  windows/        Windows .zip package with service scripts
 ```
 
 ## Formats
@@ -101,6 +103,31 @@ sudo installer -pkg deploy/fips-<version>-macos-<arch>.pkg -target /
 sudo packaging/macos/uninstall.sh
 ```
 
+### Windows (`.zip`)
+
+A ZIP archive containing binaries, default config, and PowerShell
+service helper scripts. Requires the [wintun](https://www.wintun.net/)
+driver for TUN support.
+
+```powershell
+# Build
+make zip
+
+# Or directly
+powershell -File packaging/windows/build-zip.ps1
+
+# Extract and install as service (requires Administrator)
+Expand-Archive deploy\fips-<version>-windows-x86_64.zip -DestinationPath fips
+cd fips
+powershell -File install-service.ps1
+
+# Uninstall (preserves config)
+powershell -File uninstall-service.ps1
+
+# Uninstall and remove config
+powershell -File uninstall-service.ps1 -RemoveAll
+```
+
 ### Arch Linux (AUR)
 
 Two AUR packages are maintained: `fips` (release, builds from tagged