Add .deb packaging, GitHub Actions CI/CD, and release workflows

- Makefile: add 'deb' and 'release' targets; fix migrate/create syntax
- scripts/build-deb.sh: build .deb with systemd unit, postinst/prerm/postrm
- .github/workflows/ci.yml: go build, test, lint on PR/push to main
- .github/workflows/release.yml: multi-platform build (linux/darwin/windows
  × amd64/arm64), .deb for Linux, tarballs, draft GitHub Release on tag v*
- README.md: add CI/Release badges, Install section with .deb and binary
  release instructions

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+          cache: true
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: web/frontend/package-lock.json
+
+      - name: Install frontend deps
+        run: cd web/frontend && npm ci
+
+      - name: Build frontend
+        run: cd web/frontend && npm run build
+
+      - name: Download Go deps
+        run: go mod download
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test -race -coverprofile=coverage.out ./...
+
+      - name: Lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin
+          $(go env GOPATH)/bin/golangci-lint run ./...
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage.out