add rpm packaging; dnf and firewalld support

- packaging/rpm/terraria-server-manager.spec.in: installs via make
  install, plain scriptlets (no Fedora-only macros) mirroring the deb
  maintainer scripts; removal stops servers, disables boot/backups/
  daemon and removes only terractl's own drop-ins.
- make rpm (rpmbuild --nodeps, works on Debian/Ubuntu); make check
  parses the spec when rpmspec is installed.
- Release workflow builds deb and rpm, attaches both, publishes the rpm
  to Gitea's RPM registry. Job renamed to 'packages'.
- pkg_install: install hints use dnf or apt with the right package
  names (doctor, fetch, python3/openssl checks).
- firewalld: new prints the firewall-cmd command for its port; doctor
  lists instance and daemon ports firewalld doesn't allow.
- Docs, README, AGENTS.md and changelog; VERSION 0.0.13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -2,6 +2,7 @@
 #
 #   make check                 syntax-check the scripts (and shellcheck, if installed)
 #   make deb                   build build/terraria-server-manager_<version>_all.deb
+#   make rpm                   build build/terraria-server-manager-<version>-1.noarch.rpm
 #   sudo make install          install directly (default PREFIX=/usr/local), no package
 #   sudo make uninstall        remove what 'make install' installed (keeps your data)
 #   make clean                 remove build/
@@ -33,8 +34,13 @@ SUBST = sed -e 's|@VERSION@|$(VERSION)|g' -e 's|@BINDIR@|$(BINDIR)|g' -e 's|@DOC
 MAINT_SCRIPTS := packaging/deb/postinst packaging/deb/prerm packaging/deb/postrm
 STAGE         := build/deb-root
 DEB           := build/$(NAME)_$(VERSION)_all.deb
+RPMTOP        := build/rpm
+RPM           := build/$(NAME)-$(VERSION)-1.noarch.rpm
+# What goes in the source tarball the RPM is built from
+RPM_SOURCES   := Makefile VERSION README.md CHANGELOG.md bin lib completions config docs \
+                 packaging systemd tools
 
-.PHONY: all check install uninstall deb clean
+.PHONY: all check install uninstall deb rpm clean
 
 all: check
 
@@ -48,6 +54,13 @@ check:
 	else \
 		echo "shellcheck not installed; skipped (apt install shellcheck)"; \
 	fi
+	@if command -v rpmspec >/dev/null; then \
+		spec=$$(mktemp --suffix=.spec); \
+		sed 's|@VERSION@|$(VERSION)|' packaging/rpm/$(NAME).spec.in > $$spec; \
+		rpmspec -P $$spec >/dev/null; rc=$$?; rm -f $$spec; [ $$rc -eq 0 ]; \
+	else \
+		echo "rpmspec not installed; RPM spec not checked (apt install rpm, or dnf install rpm-build)"; \
+	fi
 	@if python3 -m pyflakes --version >/dev/null 2>&1; then \
 		python3 -m pyflakes lib/terractl-remote; \
 	else \
@@ -128,5 +141,17 @@ deb: check
 	find $(STAGE) -type d -exec chmod 755 {} +
 	dpkg-deb --build --root-owner-group $(STAGE) $(DEB)
 
+# Builds with plain rpmbuild (no Fedora-specific macros), so it works on Debian
+# and Ubuntu too, with: apt install rpm
+rpm: check
+	rm -rf $(RPMTOP)
+	install -d $(RPMTOP)/SOURCES $(RPMTOP)/SPECS
+	tar -czf $(RPMTOP)/SOURCES/$(NAME)-$(VERSION).tar.gz --exclude=__pycache__ \
+		--transform 's|^|$(NAME)-$(VERSION)/|' $(RPM_SOURCES)
+	sed 's|@VERSION@|$(VERSION)|' packaging/rpm/$(NAME).spec.in > $(RPMTOP)/SPECS/$(NAME).spec
+	@# --nodeps: on Debian and Ubuntu there is no RPM database to check BuildRequires against
+	rpmbuild -bb --nodeps --define "_topdir $(CURDIR)/$(RPMTOP)" $(RPMTOP)/SPECS/$(NAME).spec
+	cp $(RPMTOP)/RPMS/noarch/$(NAME)-$(VERSION)-1.noarch.rpm $(RPM)
+
 clean:
 	rm -rf build