add rpm packaging; dnf and firewalld support

- packaging/rpm/terraria-server-manager.spec.in: installs via make
  install, plain scriptlets (no Fedora-only macros) mirroring the deb
  maintainer scripts; removal stops servers, disables boot/backups/
  daemon and removes only terractl's own drop-ins.
- make rpm (rpmbuild --nodeps, works on Debian/Ubuntu); make check
  parses the spec when rpmspec is installed.
- Release workflow builds deb and rpm, attaches both, publishes the rpm
  to Gitea's RPM registry. Job renamed to 'packages'.
- pkg_install: install hints use dnf or apt with the right package
  names (doctor, fetch, python3/openssl checks).
- firewalld: new prints the firewall-cmd command for its port; doctor
  lists instance and daemon ports firewalld doesn't allow.
- Docs, README, AGENTS.md and changelog; VERSION 0.0.13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -1,5 +1,6 @@
-# Builds the .deb when a version tag is pushed and publishes it as a release,
-# with that version's CHANGELOG.md section as the release notes. To release,
+# Builds the .deb and the .rpm when a version tag is pushed and publishes them
+# as a release, with that version's CHANGELOG.md section as the release notes,
+# and to Gitea's apt and RPM repositories. To release,
 # set VERSION and CHANGELOG.md, commit, then:
 #   git tag v$(cat VERSION) && git push origin v$(cat VERSION)
 name: release
@@ -9,7 +10,7 @@ on:
     tags: ['v*']
 
 jobs:
-  deb:
+  packages:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -27,10 +28,10 @@ jobs:
         run: |
           SUDO=$(command -v sudo || true)
           $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq make python3 dpkg curl shellcheck python3-pyflakes
+          $SUDO apt-get install -y -qq make python3 dpkg curl shellcheck python3-pyflakes rpm file
 
       - name: Build (make check runs first)
-        run: make deb
+        run: make deb rpm
 
       - name: Publish the release
         env:
@@ -38,7 +39,7 @@ jobs:
           GITEA_REPO: ${{ gitea.repository }}
           # The job's own token; set a RELEASE_TOKEN secret instead if it isn't allowed to write releases
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}
-        run: python3 packaging/gitea-release.py "$GITHUB_REF_NAME" build/*.deb
+        run: python3 packaging/gitea-release.py "$GITHUB_REF_NAME" build/*.deb build/*.rpm
 
       # Gitea's Debian registry, as an apt repository:
       #   deb <server>/api/packages/<owner>/debian stable main
@@ -64,3 +65,30 @@ jobs:
             echo "upload failed: HTTP $status"; cat response.txt; echo; exit 1
           fi
           echo "published $(basename "$deb") to $POOL"
+
+      # Gitea's RPM registry, as a dnf/yum repository:
+      #   <server>/api/packages/<owner>/rpm.repo
+      - name: Publish to the RPM repository
+        env:
+          RPMREPO: ${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/rpm
+          TOKEN: ${{ secrets.PACKAGE_TOKEN || secrets.GITEA_TOKEN }}
+        run: |
+          rpm=$(echo build/*.rpm)
+          upload() {
+            curl -sS -o response.txt -w '%{http_code}' --user "$GITHUB_ACTOR:$TOKEN" \
+              --upload-file "$rpm" "$RPMREPO/upload"
+          }
+          status=$(upload)
+          if [ "$status" = 409 ]; then
+            # This version is there already (the tag was pushed again): replace it.
+            # Gitea names the version either <version>-<release> or <version>.
+            for v in "$(cat VERSION)-1" "$(cat VERSION)"; do
+              curl -sS -f --user "$GITHUB_ACTOR:$TOKEN" -X DELETE \
+                "$RPMREPO/package/terraria-server-manager/$v/noarch" && break
+            done
+            status=$(upload)
+          fi
+          if [ "$status" != 201 ]; then
+            echo "upload failed: HTTP $status"; cat response.txt; echo; exit 1
+          fi
+          echo "published $(basename "$rpm") to $RPMREPO"