Add release pipeline: AUR packaging, Gitea workflow, MIT license

Mirrors the gpupaper release convention: v* tags build x86_64/aarch64
tarballs (binary + leptos site + systemd unit), upload them as Gitea
release assets, push bendik/cnats to Docker Hub, and update the AUR
package with checksums from the release assets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/cnats.env

@@ -0,0 +1,19 @@
+# cnats configuration — read by cnats.service (EnvironmentFile).
+# See https://prosjekt.klingenbergbygg.no/bl/cnats for details.
+
+LEPTOS_SITE_ADDR=127.0.0.1:3000
+NATS_URL=nats://127.0.0.1:4222
+DATABASE_URL=postgres://cnats:cnats@127.0.0.1:5432/cnats
+
+KANIDM_URL=https://idm.example.com
+OAUTH2_CLIENT_ID=cnats
+OAUTH2_CLIENT_SECRET=change-me
+
+# Must match a redirect URL registered on the Kanidm oauth2 client:
+# ${PUBLIC_URL}/auth/callback
+PUBLIC_URL=http://localhost:3000
+
+# Set true when served over HTTPS (production).
+COOKIE_SECURE=false
+
+RUST_LOG=info

packaging/cnats.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=cnats - web chat over NATS subjects with Kanidm SSO
+Documentation=https://prosjekt.klingenbergbygg.no/bl/cnats
+After=network-online.target nats-server.service postgresql.service
+Wants=network-online.target
+
+[Service]
+DynamicUser=yes
+EnvironmentFile=/etc/cnats/env
+Environment=LEPTOS_SITE_ROOT=/usr/share/cnats/site
+ExecStart=/usr/bin/cnats
+Restart=on-failure
+RestartSec=5
+
+# Hardening: the app only needs outbound sockets and its static site dir.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+CapabilityBoundingSet=
+
+[Install]
+WantedBy=multi-user.target