Add release pipeline: AUR packaging, Gitea workflow, MIT license

Mirrors the gpupaper release convention: v* tags build x86_64/aarch64
tarballs (binary + leptos site + systemd unit), upload them as Gitea
release assets, push bendik/cnats to Docker Hub, and update the AUR
package with checksums from the release assets.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/cnats.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=cnats - web chat over NATS subjects with Kanidm SSO
+Documentation=https://prosjekt.klingenbergbygg.no/bl/cnats
+After=network-online.target nats-server.service postgresql.service
+Wants=network-online.target
+
+[Service]
+DynamicUser=yes
+EnvironmentFile=/etc/cnats/env
+Environment=LEPTOS_SITE_ROOT=/usr/share/cnats/site
+ExecStart=/usr/bin/cnats
+Restart=on-failure
+RestartSec=5
+
+# Hardening: the app only needs outbound sockets and its static site dir.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+CapabilityBoundingSet=
+
+[Install]
+WantedBy=multi-user.target