Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/debian/postinst

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Guard: runs after the package's files are in place.
+set -e
+
+if [ "$1" = configure ]; then
+	systemd-sysusers guard.conf
+	install -d -m 0750 -o root -g guard /etc/guard
+	# An example configuration on the first install; an existing one is
+	# never touched.
+	if [ ! -e /etc/guard/guard.yaml ]; then
+		/usr/bin/guard config --example > /etc/guard/guard.yaml.dpkg-new
+		chown root:guard /etc/guard/guard.yaml.dpkg-new
+		chmod 0640 /etc/guard/guard.yaml.dpkg-new
+		mv /etc/guard/guard.yaml.dpkg-new /etc/guard/guard.yaml
+	fi
+	if [ -d /run/systemd/system ]; then
+		systemctl daemon-reload || true
+		# An upgrade restarts a running guard; a first install starts
+		# nothing (it needs Housecarl's ban list and token first).
+		if [ -n "$2" ] && systemctl is-active --quiet guard.service; then
+			systemctl restart guard.service || true
+		fi
+	fi
+fi
+
+exit 0