Add gateway packaging: CI, systemd, Debian, AUR, OpenWrt

Add fips-gateway binary to CI artifact and Docker build. Systemd
service unit with After=fips.service dependency and security
hardening. Debian and AUR package entries.

OpenWrt packaging: procd init script managing dnsmasq forwarding,
proxy NDP, RA route advertisements for the virtual IP pool, and a
global IPv6 prefix on br-lan to work around Android suppressing AAAA
queries on ULA-only networks. Sysctl config for IPv6 forwarding.
Gateway enabled by default in OpenWrt config. Ethernet transport
enabled by default.

Default gateway config section (commented out) in common fips.yaml.

.github/workflows/ci.yml

@@ -65,7 +65,7 @@ jobs:
         run: cargo build --release
 
       - name: SHA-256 hashes
-        run: sha256sum target/release/fips target/release/fipsctl target/release/fipstop
+        run: sha256sum target/release/fips target/release/fipsctl target/release/fipstop target/release/fips-gateway
 
       # Upload the Linux binary so integration jobs can use it without rebuilding
       - name: Upload Linux binary
@@ -77,6 +77,7 @@ jobs:
             target/release/fips
             target/release/fipsctl
             target/release/fipstop
+            target/release/fips-gateway
           retention-days: 1
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -222,9 +223,11 @@ jobs:
         run: |
           chmod +x _bin/fips _bin/fipsctl
           [ -f _bin/fipstop ] && chmod +x _bin/fipstop || true
+          [ -f _bin/fips-gateway ] && chmod +x _bin/fips-gateway || true
           cp _bin/fips    testing/docker/fips
           cp _bin/fipsctl testing/docker/fipsctl
           [ -f _bin/fipstop ] && cp _bin/fipstop testing/docker/fipstop || true
+          [ -f _bin/fips-gateway ] && cp _bin/fips-gateway testing/docker/fips-gateway || true
           docker build -t fips-test:latest testing/docker
           docker build -t fips-test-app:latest -f testing/docker/Dockerfile.app testing/docker