Adds the apt_repository / apt steps that pull authforge-daemon, -pam,
and -cli (with -gui gated behind authforge_install_gui), the template
step that renders /etc/authforge/policy.d/90-fleet.conf and notifies the
restart handler, and a loop that calls `authforgectl pending set` for
each entry in authforge_pending_users.
The template emits TOML that round-trips through tomllib for both the
empty-stacks default and a populated multi-stack config.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
