add rpm packaging; dnf and firewalld support

- packaging/rpm/terraria-server-manager.spec.in: installs via make
  install, plain scriptlets (no Fedora-only macros) mirroring the deb
  maintainer scripts; removal stops servers, disables boot/backups/
  daemon and removes only terractl's own drop-ins.
- make rpm (rpmbuild --nodeps, works on Debian/Ubuntu); make check
  parses the spec when rpmspec is installed.
- Release workflow builds deb and rpm, attaches both, publishes the rpm
  to Gitea's RPM registry. Job renamed to 'packages'.
- pkg_install: install hints use dnf or apt with the right package
  names (doctor, fetch, python3/openssl checks).
- firewalld: new prints the firewall-cmd command for its port; doctor
  lists instance and daemon ports firewalld doesn't allow.
- Docs, README, AGENTS.md and changelog; VERSION 0.0.13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -7,7 +7,8 @@ Guidance for AI agents (and people) working on this repository.
 `terraria-server-manager` runs any number of vanilla Terraria and tModLoader
 dedicated servers on one Linux host, each as its own systemd service
 (`terraria@<name>.service`), managed with the `terractl` command. It ships as a
-Debian package. Server software is never bundled: official zips go in
+Debian package and an RPM (Fedora, RHEL 9+), both built from the same
+`make install`. Server software is never bundled: official zips go in
 `/var/lib/terraria/dist` and are unpacked into each instance on demand.
 
 The user-facing documentation is `docs/guide.md` (installed as the package's
@@ -24,8 +25,9 @@ the specification of how things behave.
 | `systemd/` | `terraria@.service`/`.socket` (one per instance), `terractld.service` (daemon for other hosts), `terraria-backup@.service`/`.timer` (scheduled backups). |
 | `config/` | `default/terractl` (user overrides, a conffile), `tmpfiles.d`, `sysusers.d`, `polkit` rule, `journald@terraria.conf` (a conffile). |
 | `packaging/deb/` | `control`, `conffiles`, maintainer scripts (`postinst`, `prerm`, `postrm`). |
+| `packaging/rpm/` | `terraria-server-manager.spec.in`: the RPM spec (`@VERSION@` filled in by `make rpm`). Plain scriptlets, no Fedora-only macros, so it builds anywhere `rpmbuild` runs. |
 | `packaging/gitea-release.py` | Publishes a release with that version's CHANGELOG section as notes. |
-| `.gitea/workflows/release.yaml` | On a `v*` tag: `make deb`, publish the release and the apt repository. |
+| `.gitea/workflows/release.yaml` | On a `v*` tag: `make deb rpm` (on Ubuntu), publish the release and the apt and RPM repositories. |
 | `tools/windows/export-tmod-mods.ps1` | Helper for players to export their enabled tModLoader mods. |
 | `docs/guide.md`, `README.md`, `CHANGELOG.md`, `VERSION` | Docs and release metadata. |
 
@@ -39,8 +41,13 @@ unfilled placeholders and uses `lib/terractl-remote` from the source tree.
 ```bash
 make check     # bash -n, sh -n on maintainer scripts, Python syntax, shellcheck, pyflakes
 make deb       # runs check, builds build/terraria-server-manager_<version>_all.deb
+make rpm       # runs check, builds build/terraria-server-manager-<version>-1.noarch.rpm
 ```
 
+`make rpm` needs `rpmbuild` (`apt install rpm` works; it runs with `--nodeps`
+because Debian has no RPM database). `make check` parses the spec with `rpmspec`
+when it's installed.
+
 **`make check` must pass with shellcheck installed** (`apt install shellcheck
 python3-pyflakes`). The release workflow runs it, so a shellcheck warning blocks
 a release. Fix warnings rather than disabling them; a `# shellcheck disable=`
@@ -125,9 +132,25 @@ These invariants run through the whole code base. Keep them.
 
 ### Shell in packaging
 
-- Maintainer scripts are POSIX `sh`, idempotent, and must never fail an
-  install or removal because systemd isn't running (`[ -d /run/systemd/system ]`
-  guards, `|| true` on best-effort steps).
+- Maintainer scripts and RPM scriptlets are POSIX `sh`, idempotent, and must
+  never fail an install or removal because systemd isn't running
+  (`[ -d /run/systemd/system ]` guards, `|| true`/`|| :` on best-effort steps).
+- **The two packages must behave the same.** A change to `packaging/deb/`
+  scripts needs the matching change in the spec's `%post`/`%preun`/`%postun`,
+  and the other way round. RPM scriptlets get `$1` as a count (`%post`: 1 =
+  install, 2+ = upgrade; `%preun`/`%postun`: 0 = removal) where dpkg gets
+  words. rpm has no purge: `%postun` on removal does a careful subset of the
+  Debian purge (never deleting admin files or data).
+
+### Portability
+
+- Debian/Ubuntu and Fedora/RHEL are both supported. Don't hard-code `apt`:
+  suggest installs with `pkg_install "<sudo prefix>" <what>` (maps package
+  names per system), and mention both in the docs where commands differ.
+- Fedora and RHEL run firewalld by default; features that open a port should
+  say how to allow it (`firewalld_open_cmd`), never open it automatically.
+- SELinux (enforcing on Fedora/RHEL) hasn't been looked at yet; note anything
+  that might be affected (new executables, sockets, paths) in the PR.
 
 ## Adding or changing a command: checklist
 
@@ -151,9 +174,11 @@ These invariants run through the whole code base. Keep them.
 5. `README.md` features list, for user-visible features.
 6. `CHANGELOG.md`: an entry in the newest section (see [Changelog](#changelog)).
 7. New installed files: `Makefile` `install` **and** `uninstall`, unit files
-   through `$(SUBST)` if they contain placeholders, `packaging/deb/postrm`
-   (purge) for anything created at runtime, and `conffiles` for files in
-   `/etc` that users edit.
+   through `$(SUBST)` if they contain placeholders, the RPM spec's `%files`
+   (a file missing there fails `make rpm`), `packaging/deb/postrm` (purge) and
+   the spec's `%postun` for anything created at runtime, and `conffiles` plus
+   `%config(noreplace)` for files in `/etc` that users edit. New dependencies go
+   in both `packaging/deb/control` and the spec (package names can differ).
 8. If it affects what can go wrong on a host, consider a check in `doctor`
    (`doc_problem warn|FAIL "<what>" "<fix command>" [<function that fixes it>]`;
    only pass a fix function for fixes that are safe to apply unattended).
@@ -234,7 +259,7 @@ reads well there.
 - To release: set the date, commit, then tag **`v<version>`** (annotated,
   message `terraria-server-manager <version>`). The workflow refuses a tag that
   doesn't match `VERSION`. Pushing the tag builds and publishes the release and
-  the apt repository, so only push when asked.
+  the apt and RPM repositories, so only push when asked.
 
 ## Git