Add Windows platform support (#45)

Gate platform-specific code behind cfg attributes and add full Windows
  support: TUN device via wintun, TCP control socket on localhost:21210,
  Windows Service lifecycle (--install-service/--uninstall-service/--service),
  CI build and test matrix, and packaging with ZIP builder and PowerShell
  service management scripts.

  Key changes:

  - Cargo.toml: move tun/libc/rtnetlink behind cfg(unix); add wintun and
    windows-service dependencies for Windows
  - upper/tun.rs: wintun-based TUN implementation with netsh configuration
    for IPv6 address, MTU, and fd00::/8 routing
  - control/mod.rs: split into unix_impl/windows_impl; Windows uses TCP on
    localhost:21210 with shared connection handler
  - bin/fips.rs: refactor main() into run_daemon() accepting a shutdown
    signal; add Windows Service support via windows-service crate
  - transport/udp/socket.rs: platform-gated modules; Windows uses
    tokio::net::UdpSocket (kernel drop count unavailable, returns 0)
  - transport/ethernet: gate to cfg(unix); add Windows stub types
  - config: platform-conditional default paths (socket, hosts) for Windows
  - CI: add windows-latest to build matrix and test-windows job with
    cargo-nextest
  - packaging/windows: build-zip.ps1, install-service.ps1,
    uninstall-service.ps1, and package-windows.yml workflow
  - README/docs: Windows build instructions, service management, and
    control socket platform differences

  Linux and macOS behavior is unchanged.

README.md

@@ -63,8 +63,8 @@ cd fips
 cargo build --release
 ```
 
-Requires Rust 1.85+ (edition 2024) and a Unix-like OS with TUN support
-(Linux or macOS).
+Requires Rust 1.85+ (edition 2024). Linux, macOS, and Windows are
+supported (see transport matrix below).
 
 ### Transport support by platform
 
@@ -159,6 +159,44 @@ sudo tail -f /usr/local/var/log/fips/fips.log
 > **Note:** On macOS, the TUN device is named `utun<N>` (kernel-assigned)
 > rather than `fips0`.
 
+### Windows
+
+Build without BLE (requires Linux-only libdbus):
+
+```powershell
+cargo build --release --no-default-features --features tui
+```
+
+The [wintun](https://www.wintun.net/) driver is required for TUN support.
+Download `wintun.dll` and place it in the same directory as `fips.exe`.
+Running the daemon requires Administrator privileges for TUN creation.
+
+**Foreground mode:**
+
+```powershell
+.\fips.exe -c fips.yaml
+```
+
+**Windows Service:**
+
+```powershell
+# Install (requires Administrator)
+.\fips.exe --install-service
+
+# Manage via standard service tools
+sc start fips
+sc stop fips
+
+# Uninstall
+.\fips.exe --uninstall-service
+```
+
+Place `fips.yaml` in the current directory or `%APPDATA%\fips\`, or set
+the `FIPS_CONFIG` environment variable.
+
+The control socket uses TCP on `localhost:21210` instead of a Unix domain
+socket. `fipsctl` and `fipstop` connect to this port automatically.
+
 ## Configuration
 
 The default configuration file is installed at `/etc/fips/fips.yaml`: