Add Azure deployment examples and enhance configuration management

- Update .gitignore to exclude Terraform files
- Enhance README with Azure deployment instructions
- Refactor publish.sh to use a container for changelog parsing
- Add Azure example files including Terraform configurations
- Create cloud-init templates for PKI and default configurations
- Implement workload VM setup for testing routing

examples/azure/README.md

@@ -0,0 +1,45 @@
+# Azure example
+
+Deploys `vpn-router` on an Azure VM: a two-NIC router (external/WAN and internal/protected),
+a demo protected `workload` subnet routed through it, and cloud-init that installs and
+configures the package on first boot. See the repository's top-level [README](../../README.md)
+for what the package itself does.
+
+## Prerequisites
+
+- An Azure subscription and `az login` (or another form of Azure credentials Terraform can pick
+  up).
+- An SSH key pair for `admin_ssh_public_key`.
+- A build of the `vpn-router` package published to the repository at `repo_url` (default: the
+  project's Gitea Debian registry). See [../../debian-package](../../debian-package) for
+  `build.sh`/`publish.sh`.
+- That repository must allow anonymous reads, since the router pulls the package with no
+  credentials configured. On Gitea this means the `debian` package registry under the
+  `slawek` account is set to public/anonymous-read; `publish.sh` still authenticates to
+  upload, only reads are anonymous. This is a one-time change made on the Gitea side, outside
+  this repository.
+
+## Usage
+
+```sh
+cp terraform.tfvars.example terraform.tfvars
+$EDITOR terraform.tfvars
+export TF_VAR_psk='change-me'   # keep secrets out of tracked files
+```
+
+`platform = azure` and `mode = auto` are hard-coded into the cloud-init template call in
+`router.tf`: the router has exactly two NICs, the external one carries the default route (it is
+marked `primary` and holds the public IP), which is exactly the case `mode = auto` is designed
+to detect reliably - see the top-level README's "What mode decides" section.
+
+## Verifying
+
+```sh
+ssh <admin_username>@$(terraform output -raw router_public_ip)
+systemctl status vpn-router-setup
+swanctl --list-sas
+```
+
+Set `deploy_workload_vm = true` and re-apply to add a VM on the `workload` subnet (no public
+IP - reach it via the router or Azure Bastion) for confirming that its traffic to `remote_cidrs`
+actually flows through the router.