Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/debian/postinst

@@ -6,6 +6,8 @@ case "$1" in
     configure)
         # --- Read the installer's answers ---
         db_get vpn-router/platform;         VPN_ROUTER_PLATFORM="$RET"
+        db_get vpn-router/mode;             VPN_ROUTER_MODE="$RET"
+        db_get vpn-router/int_addr;         VPN_ROUTER_INT_ADDR="$RET"
         db_get vpn-router/external_interface; VPN_ROUTER_EXTERNAL_INTERFACE="$RET"
         db_get vpn-router/internal_interface; VPN_ROUTER_INTERNAL_INTERFACE="$RET"
         db_get vpn-router/local_fqdn;       VPN_ROUTER_LOCAL_FQDN="$RET"
@@ -23,7 +25,8 @@ case "$1" in
         db_get vpn-router/wg_address;       VPN_ROUTER_WG_ADDRESS="$RET"
         db_get vpn-router/wg_listen_port;   VPN_ROUTER_WG_LISTEN_PORT="$RET"
 
-        export VPN_ROUTER_PLATFORM VPN_ROUTER_EXTERNAL_INTERFACE \
+        export VPN_ROUTER_PLATFORM VPN_ROUTER_MODE VPN_ROUTER_INT_ADDR \
+               VPN_ROUTER_EXTERNAL_INTERFACE \
                VPN_ROUTER_INTERNAL_INTERFACE VPN_ROUTER_LOCAL_FQDN \
                VPN_ROUTER_LOCAL_ID_MODE VPN_ROUTER_LOCAL_CIDRS \
                VPN_ROUTER_INT_GATEWAY_IP \
@@ -33,10 +36,20 @@ case "$1" in
                VPN_ROUTER_P2S_CA_NAME VPN_ROUTER_WG_ENABLED \
                VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT
 
-        # --- Create the configuration file, only if it does not exist ---
-        /usr/lib/vpn-router/seed-config
+        # --- Hand a candidate configuration to ucf ---
+        # ucf compares it against the file in /etc and decides what to do about
+        # local changes, prompting through debconf only for a real conflict.
+        # This is what makes dpkg-reconfigure apply without destroying edits.
+        CANDIDATE="$(mktemp)"
+        /usr/lib/vpn-router/generate-config "$CANDIDATE"
+        ucf --three-way --debconf-ok "$CANDIDATE" /etc/vpn-router/vpn-router.conf
+        ucfr vpn-router /etc/vpn-router/vpn-router.conf
+        chmod 0600 /etc/vpn-router/vpn-router.conf
+        rm -f "$CANDIDATE"
 
-        # The key now lives in the configuration file; do not keep a copy.
+        # The key now lives in the configuration file; do not keep a copy. An
+        # empty answer means "leave alone" next time, so clearing it here does
+        # not blank the key on the next dpkg-reconfigure.
         db_set vpn-router/psk ""
 
         # Apply the sysctl drop-in shipped by this package so it takes effect