Add a Debian package and bash completion

make deb builds dist/jarl_<version>_<arch>.deb with dpkg-deb alone (no
root), for the host or another architecture (DEB_ARCH=arm64). The package
creates the jarl user and directories and an example jarl.yaml on the
first install, restarts a running jarld on upgrades, never touches
/etc/jarl/jarl.yaml, stops jarld on removal, and keeps Jarl's data even
on purge.

make install and the package install bash completion for jarl and jarld.
Besides commands and flags it completes server and group names from the
CLI configuration, zone, view, ACL, TSIG key and user names from the
server, and record types. make dist includes the completion scripts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/install.md

@@ -22,10 +22,49 @@ make dist       # optional: dist/jarl-<version>-linux-{amd64,arm64}.tar.gz
 ```
 
 If you build on another machine, copy the binaries plus the `deploy/`,
-`docs/` and `contrib/` directories to the DNS server.
+`docs/` and `contrib/` directories to the DNS server, or build a Debian
+package (below) and copy that.
 
 ## 2. Install the files
 
+There are two ways: a Debian package, which is easiest to upgrade and
+remove, or `make install`.
+
+### With the Debian package
+
+```sh
+make deb                                  # dist/jarl_0.1.0_amd64.deb
+make deb DEB_ARCH=arm64                   # for another architecture (also armhf, i386, ...)
+sudo apt install ./dist/jarl_0.1.0_amd64.deb
+```
+
+`make deb` needs only `dpkg-deb` (no root, no debhelper) and cross-builds
+for any architecture Go supports. apt also installs `bind9` (recommended)
+if it's missing. Installing the package:
+
+* puts the binaries in `/usr/bin`, bash completion in
+  `/usr/share/bash-completion/completions`, the systemd unit in
+  `/usr/lib/systemd/system/jarl.service`, the sysusers and tmpfiles files
+  in `/usr/lib`, and the docs and contrib files in `/usr/share/doc/jarl`;
+* creates the `jarl` user (in group `bind`) and Jarl's directories, and
+  writes `/etc/jarl/jarl.yaml` from the example on the first install. No
+  file in `/etc` belongs to the package, so your configuration is never
+  replaced or asked about on upgrades;
+* doesn't start jarld: continue with [3. Configure](#3-configure), then
+  `systemctl enable --now jarl` in step 8.
+
+**Upgrading**: build and install the newer package the same way. A running
+jarld is restarted, and upgrades its database as it starts.
+
+**Removing** (`sudo apt remove jarl`) stops jarld and removes the program,
+but named keeps running with the configuration Jarl last wrote. Even
+`apt purge jarl` keeps `/etc/jarl`, `/var/lib/jarl` (the database) and the
+files in `/etc/bind/jarl`, `/var/lib/bind/jarl` and `/var/cache/bind/jarl`,
+since named.conf may still include them. Remove them by hand once named no
+longer uses them.
+
+### With make install
+
 On the DNS server, as root:
 
 ```sh
@@ -37,6 +76,7 @@ This installs:
 | File | Purpose |
 |------|---------|
 | `/usr/local/bin/jarld`, `/usr/local/bin/jarl` | daemon and CLI |
+| `/usr/local/share/bash-completion/completions/jarl`, `.../jarld` | bash completion (loaded automatically by the `bash-completion` package) |
 | `/etc/systemd/system/jarl.service` | systemd unit (`Type=notify`, sandboxed) |
 | `/usr/lib/sysusers.d/jarl.conf` | creates the `jarl` system user and adds it to group `bind` |
 | `/usr/lib/tmpfiles.d/jarl.conf` | creates `/etc/jarl`, `/var/lib/jarl`, `/etc/bind/jarl`, `/var/lib/bind/jarl`, `/var/cache/bind/jarl` |