Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/debian/postrm

@@ -34,6 +34,15 @@ case "$1" in
     purge)
         strip_ufw_blocks
 
+        # Let ucf forget the file before it is removed, or a reinstall finds a
+        # stale hash and declines to lay the file down again.
+        if command -v ucf >/dev/null 2>&1; then
+            ucf --purge /etc/vpn-router/vpn-router.conf
+        fi
+        if command -v ucfr >/dev/null 2>&1; then
+            ucfr --purge vpn-router /etc/vpn-router/vpn-router.conf
+        fi
+
         rm -f /etc/swanctl/conf.d/remote-site.conf \
               /etc/swanctl/conf.d/road-warrior.conf \
               /etc/systemd/resolved.conf.d/p2s-forwarder.conf \