feat(pkg): metapackage postinst seeds /etc/authforge/policy.d/00-debconf.conf from debconf answer

debian/authforge.postinst

@@ -0,0 +1,66 @@
+#!/bin/sh
+# Reads the debconf answer and writes /etc/authforge/policy.d/00-debconf.conf
+# exactly once, on first install. Subsequent upgrades/reconfigures don't
+# touch the file — admin edits via authforgectl/GUI win.
+set -e
+
+# shellcheck source=/dev/null
+. /usr/share/debconf/confmodule
+
+POLICY_DIR=/etc/authforge/policy.d
+SEED_FILE=$POLICY_DIR/00-debconf.conf
+
+case "$1" in
+    configure)
+        # Only seed on first install: $2 is empty when no previous version
+        # was configured. Skip if the seed file already exists (admin may
+        # have written one manually before apt configured the metapackage).
+        if [ -z "$2" ] && [ ! -e "$SEED_FILE" ]; then
+            db_get authforge/initial-policy || true
+            mkdir -p "$POLICY_DIR"
+            case "$RET" in
+                "None")
+                    : # no seed — leave dir empty
+                    ;;
+                "Optional everywhere")
+                    cat > "$SEED_FILE" <<'EOF'
+# /etc/authforge/policy.d/00-debconf.conf
+# Seeded by debconf on first install. Edit via `authforgectl policy set`
+# or the AuthForge GUI; admin edits override on next daemon reload.
+[stacks.gdm-password]
+mode = "optional"
+methods = ["fido2"]
+
+[stacks.sudo]
+mode = "optional"
+methods = ["fido2", "totp"]
+
+[stacks.sshd]
+mode = "optional"
+methods = ["fido2"]
+EOF
+                    ;;
+                "Required for sudo")
+                    cat > "$SEED_FILE" <<'EOF'
+# /etc/authforge/policy.d/00-debconf.conf
+# Seeded by debconf on first install. Edit via `authforgectl policy set`
+# or the AuthForge GUI; admin edits override on next daemon reload.
+[stacks.sudo]
+mode = "required"
+methods = ["fido2", "totp"]
+EOF
+                    ;;
+            esac
+        fi
+        ;;
+    abort-upgrade|abort-remove|abort-deconfigure)
+        ;;
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0