feat: add packaging, deployment, error pages, and project docs

Phase 7 — Polish:
- Error page template with styled 404/403/500 pages
- Error rendering helper on Renderer

Phase 8 — Packaging & Deployment:
- Containerfile: multi-stage build, non-root user, health check,
  OCI labels with build date and git revision
- Makefile: build, test, cross-compile, deb, rpm, container,
  tarballs, checksums targets
- nfpm.yaml: .deb and .rpm package config
- systemd service: hardened with NoNewPrivileges, ProtectSystem,
  ProtectHome, PrivateTmp, RestrictSUIDSGID
- Default environment file with commented examples
- postinstall/preremove scripts (shellcheck validated)
- compose.yaml: example Podman/Docker Compose
- Caddyfile.example: subdomain, subpath, and remote proxy configs
- CHANGELOG.md for release notes
- CLAUDE.md with architecture, conventions, and quick reference

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -0,0 +1,85 @@
+# Favoritter build system
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+VERSION    ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+BUILD_DATE := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
+LDFLAGS    := -s -w -X main.version=$(VERSION) -X main.buildDate=$(BUILD_DATE)
+PLATFORMS  := linux/amd64 linux/arm64
+DIST       := dist
+
+.PHONY: build build-all deb rpm container artifacts checksums clean test lint
+
+## Build for current platform
+build:
+	go build -ldflags="$(LDFLAGS)" -o favoritter ./cmd/favoritter
+
+## Run tests
+test:
+	go test ./...
+
+## Cross-compile for all platforms
+build-all: $(DIST)
+	@for platform in $(PLATFORMS); do \
+		os=$${platform%%/*}; \
+		arch=$${platform##*/}; \
+		echo "Building $$os/$$arch..."; \
+		CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch \
+			go build -ldflags="$(LDFLAGS)" \
+			-o $(DIST)/favoritter_$(VERSION)_$${os}_$${arch} \
+			./cmd/favoritter; \
+	done
+
+## Build .deb packages (requires nfpm)
+deb: build-all
+	@for platform in $(PLATFORMS); do \
+		arch=$${platform##*/}; \
+		echo "Packaging deb for $$arch..."; \
+		ARCH=$$arch VERSION=$(VERSION) nfpm package \
+			--packager deb \
+			--target $(DIST)/favoritter_$(VERSION)_$${arch}.deb; \
+	done
+
+## Build .rpm packages (requires nfpm)
+rpm: build-all
+	@for platform in $(PLATFORMS); do \
+		arch=$${platform##*/}; \
+		echo "Packaging rpm for $$arch..."; \
+		ARCH=$$arch VERSION=$(VERSION) nfpm package \
+			--packager rpm \
+			--target $(DIST)/favoritter_$(VERSION)_$${arch}.rpm; \
+	done
+
+## Build container image
+container:
+	BUILDAH_FORMAT=docker podman build \
+		--build-arg BUILD_DATE="$(BUILD_DATE)" \
+		--build-arg GIT_REVISION="$(VERSION)" \
+		--build-arg VERSION="$(VERSION)" \
+		-t favoritter:$(VERSION) \
+		-t favoritter:latest .
+
+## Package binaries into tarballs
+tarballs: build-all
+	@for platform in $(PLATFORMS); do \
+		os=$${platform%%/*}; \
+		arch=$${platform##*/}; \
+		name=favoritter_$(VERSION)_$${os}_$${arch}; \
+		echo "Creating tarball $$name.tar.gz..."; \
+		tar -czf $(DIST)/$$name.tar.gz \
+			-C $(DIST) $${name} \
+			-C $(CURDIR) README.md LICENSE; \
+	done
+
+## Generate SHA256 checksums
+checksums:
+	cd $(DIST) && sha256sum *.tar.gz *.deb *.rpm 2>/dev/null > checksums.txt || true
+
+## Build all release artifacts
+artifacts: tarballs deb rpm checksums
+
+## Clean build artifacts
+clean:
+	rm -rf $(DIST) favoritter
+
+$(DIST):
+	mkdir -p $(DIST)