feat(pkg): authforge-pam postinst calls pam-auth-update --package

debian/authforge-pam.postinst

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Registers /usr/share/pam-configs/authforge via pam-auth-update on first
+# install and reconfigure events. The profile ships Default: no, so this
+# is a no-op for fresh installs — the metapackage's debconf flow flips it
+# on if the admin opted in. Idempotent: safe to call repeatedly.
+set -e
+
+case "$1" in
+    configure)
+        if [ -x /usr/sbin/pam-auth-update ]; then
+            pam-auth-update --package
+        fi
+        ;;
+    abort-upgrade|abort-remove|abort-deconfigure)
+        ;;
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0