Native VM install kit: systemd units, launcher, install and upgrade scripts; backups, restore and doctor without docker exec; DEPLOY.md VM, NPM and NFS sections

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/vm/systemd/packetstation-firewall.service

@@ -0,0 +1,21 @@
+# Packet Station: only NPM on docker-1 (TRUSTED_PROXY_HOST) and the VM itself may reach port 8000.
+# Loads /etc/packetstation/packetstation.nft, which deploy/vm/install.sh writes from the env file.
+# The table is Packet Station's own (inet packetstation); other rules on the VM are left alone.
+[Unit]
+Description=Packet Station firewall for the app port
+Documentation=file:///opt/packetstation/current/docs/DEPLOY.md
+Before=network-pre.target packetstation-app.service
+Wants=network-pre.target
+# A restart of nftables.service flushes the whole ruleset. Load the table again after it.
+After=nftables.service
+PartOf=nftables.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/nft -f /etc/packetstation/packetstation.nft
+ExecReload=/usr/sbin/nft -f /etc/packetstation/packetstation.nft
+ExecStop=-/usr/sbin/nft delete table inet packetstation
+
+[Install]
+WantedBy=multi-user.target