Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/debian/prerm

@@ -9,8 +9,16 @@ case "$1" in
         if [ -d /run/systemd/system ]; then
             swanctl --terminate --ike remote-site >/dev/null 2>&1 || true
             swanctl --terminate --ike road-warrior >/dev/null 2>&1 || true
-            # This package enabled wg-quick@wg0, so it takes it down again.
-            systemctl disable --now wg-quick@wg0 >/dev/null 2>&1 || true
+        fi
+
+        # This package enabled wg-quick@wg0, so it takes it down again. Use the
+        # debhelper wrappers rather than systemctl, so the script behaves on a
+        # machine without systemd.
+        if command -v deb-systemd-invoke >/dev/null 2>&1; then
+            deb-systemd-invoke stop wg-quick@wg0.service >/dev/null 2>&1 || true
+        fi
+        if command -v deb-systemd-helper >/dev/null 2>&1; then
+            deb-systemd-helper disable wg-quick@wg0.service >/dev/null 2>&1 || true
         fi
         ;;
 esac