Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/debian/config

@@ -2,13 +2,45 @@
 set -e
 . /usr/share/debconf/confmodule
 
+# Every question has a default, so a non-interactive install with nothing
+# preseeded completes without prompting. The defaults are platform "none" and
+# mode "manual", which together mean: install the files, configure nothing.
+
 db_input high vpn-router/platform || true
-db_input high vpn-router/external_interface || true
-db_input high vpn-router/internal_interface || true
+db_go || true
+
+db_get vpn-router/platform
+if [ "$RET" = "none" ]; then
+    # Configuration is deferred. Asking anything else would collect answers
+    # that nothing is going to apply.
+    exit 0
+fi
+
+db_input high vpn-router/mode || true
+db_go || true
+
+# The mode says how much the operator supplies, so it decides which interface
+# and address questions are worth asking.
+db_get vpn-router/mode
+case "$RET" in
+    manual)
+        db_input high vpn-router/external_interface || true
+        db_input high vpn-router/internal_interface || true
+        db_input high vpn-router/int_addr || true
+        db_input high vpn-router/int_gateway_ip || true
+        ;;
+    interfaces)
+        db_input high vpn-router/external_interface || true
+        db_input high vpn-router/internal_interface || true
+        ;;
+    auto)
+        ;;
+esac
+db_go || true
+
 db_input high vpn-router/local_fqdn || true
 db_input high vpn-router/local_id_mode || true
 db_input high vpn-router/local_cidrs || true
-db_input high vpn-router/int_gateway_ip || true
 db_input high vpn-router/remote_addrs || true
 db_input high vpn-router/remote_id || true
 db_input high vpn-router/remote_cidrs || true