aur: bring AUR packaging to .deb parity

Three changes folded together close the AUR-side parity gap with the
.deb packaging:

- PKGBUILD now ships fips.nft baseline and fips-firewall.service, with
  fips.nft marked as backup so operator edits survive upgrades.
- PKGBUILD-git mirrors the release PKGBUILD: installs fips-gateway
  (was missing entirely), ships fips.nft and fips-firewall.service,
  and tracks the same backup() set.
- packaging/aur/README.md documents the gateway, firewall service,
  and nft baseline that ship as of this revision.

AUR users now receive the same artifact set as .deb users.

packaging/aur/PKGBUILD

@@ -10,7 +10,7 @@ depends=('gcc-libs' 'glibc')
 makedepends=('cargo')
 optdepends=('systemd-resolved: .fips DNS resolution')
 conflicts=('fips-git')
-backup=('etc/fips/fips.yaml' 'etc/fips/hosts')
+backup=('etc/fips/fips.yaml' 'etc/fips/hosts' 'etc/fips/fips.nft')
 install=fips.install
 source=("$pkgname-$pkgver.tar.gz::https://github.com/jmcorgan/fips/archive/v$pkgver.tar.gz"
         "fips.sysusers"
@@ -51,10 +51,12 @@ package() {
     install -Dm0644 packaging/debian/fips.service "$pkgdir/usr/lib/systemd/system/fips.service"
     install -Dm0644 packaging/debian/fips-dns.service "$pkgdir/usr/lib/systemd/system/fips-dns.service"
     install -Dm0644 packaging/debian/fips-gateway.service "$pkgdir/usr/lib/systemd/system/fips-gateway.service"
+    install -Dm0644 packaging/debian/fips-firewall.service "$pkgdir/usr/lib/systemd/system/fips-firewall.service"
 
     # Config files (from packaging/common/)
     install -Dm0600 packaging/common/fips.yaml "$pkgdir/etc/fips/fips.yaml"
     install -Dm0644 packaging/common/hosts "$pkgdir/etc/fips/hosts"
+    install -Dm0644 packaging/common/fips.nft "$pkgdir/etc/fips/fips.nft"
 
     # System integration (from local source files in $srcdir)
     install -Dm0644 "$srcdir/fips.sysusers" "$pkgdir/usr/lib/sysusers.d/fips.conf"

packaging/aur/PKGBUILD-git

@@ -11,7 +11,7 @@ makedepends=('cargo' 'git')
 optdepends=('systemd-resolved: .fips DNS resolution')
 provides=('fips')
 conflicts=('fips')
-backup=('etc/fips/fips.yaml' 'etc/fips/hosts')
+backup=('etc/fips/fips.yaml' 'etc/fips/hosts' 'etc/fips/fips.nft')
 install=fips.install
 source=("fips::git+https://github.com/jmcorgan/fips.git"
         "fips.sysusers"
@@ -52,14 +52,18 @@ package() {
     install -Dm0755 target/release/fips "$pkgdir/usr/bin/fips"
     install -Dm0755 target/release/fipsctl "$pkgdir/usr/bin/fipsctl"
     install -Dm0755 target/release/fipstop "$pkgdir/usr/bin/fipstop"
+    install -Dm0755 target/release/fips-gateway "$pkgdir/usr/bin/fips-gateway"
 
     # Systemd service files (from packaging/debian/ -- correct /usr/bin/ paths)
     install -Dm0644 packaging/debian/fips.service "$pkgdir/usr/lib/systemd/system/fips.service"
     install -Dm0644 packaging/debian/fips-dns.service "$pkgdir/usr/lib/systemd/system/fips-dns.service"
+    install -Dm0644 packaging/debian/fips-gateway.service "$pkgdir/usr/lib/systemd/system/fips-gateway.service"
+    install -Dm0644 packaging/debian/fips-firewall.service "$pkgdir/usr/lib/systemd/system/fips-firewall.service"
 
     # Config files (from packaging/common/)
     install -Dm0600 packaging/common/fips.yaml "$pkgdir/etc/fips/fips.yaml"
     install -Dm0644 packaging/common/hosts "$pkgdir/etc/fips/hosts"
+    install -Dm0644 packaging/common/fips.nft "$pkgdir/etc/fips/fips.nft"
 
     # System integration (from local source files in $srcdir)
     install -Dm0644 "$srcdir/fips.sysusers" "$pkgdir/usr/lib/sysusers.d/fips.conf"

packaging/aur/README.md

@@ -23,6 +23,22 @@ Both PKGBUILDs reference files from `packaging/debian/` (service files) and
 `packaging/common/` (config files) at build time. These are pulled from the
 source tree during `package()`, not from this directory.
 
+### What Gets Installed
+
+Both PKGBUILDs install the same payload, kept at parity with the Debian
+package:
+
+- Binaries: `fips`, `fipsctl`, `fipstop`, `fips-gateway`
+- Systemd units: `fips.service`, `fips-dns.service`, `fips-gateway.service`,
+  `fips-firewall.service`
+- Config: `/etc/fips/fips.yaml`, `/etc/fips/hosts`, `/etc/fips/fips.nft`
+- sysusers/tmpfiles fragments for the `fips` group and `/run/fips/`
+
+The `fips.nft` baseline is shipped as a conffile (listed in `backup=()`) so
+operator edits to the nftables ruleset survive package upgrades.
+`fips-firewall.service` is shipped disabled by default, matching the Debian
+package: operators opt in by enabling it explicitly.
+
 ## Local Build and Validation
 
 Build and validate the `-git` package locally using the Makefile target: