feat(pkg): debconf prompt for initial AuthForge policy on metapackage install

debian/authforge.config

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Asks the admin for an initial policy. Postinst (Task 6) reads the
+# answer and writes /etc/authforge/policy.d/00-debconf.conf on first
+# install only. Re-runs (e.g. `dpkg-reconfigure authforge`) re-prompt
+# but do not overwrite an existing seed file unless the admin chose to.
+set -e
+
+# shellcheck source=/dev/null
+. /usr/share/debconf/confmodule
+
+db_input medium authforge/initial-policy || true
+db_go || true
+
+exit 0

debian/authforge.templates

@@ -0,0 +1,12 @@
+Template: authforge/initial-policy
+Type: select
+Default: None
+Choices: None, Optional everywhere, Required for sudo
+Description: Initial AuthForge policy:
+ AuthForge can write a starter policy at install time. Choose:
+ .
+  None — install only, no MFA enforcement (admins configure later).
+  Optional everywhere — every PAM stack offers FIDO2/TOTP but doesn't require it.
+  Required for sudo — sudo prompts for FIDO2 or recovery code in addition to the password.
+ .
+ You can change this any time later via the AuthForge GUI or `authforgectl policy set`.

debian/control

@@ -18,6 +18,7 @@ Vcs-Git: https://github.com/dangerousthings/authforge.git
 
 Package: authforge
 Architecture: any
+Pre-Depends: debconf (>= 0.5) | debconf-2.0
 Depends: authforge-daemon (= ${binary:Version}),
          authforge-pam (= ${binary:Version}),
          authforge-cli (= ${binary:Version}),