add rpm packaging; dnf and firewalld support

- packaging/rpm/terraria-server-manager.spec.in: installs via make
  install, plain scriptlets (no Fedora-only macros) mirroring the deb
  maintainer scripts; removal stops servers, disables boot/backups/
  daemon and removes only terractl's own drop-ins.
- make rpm (rpmbuild --nodeps, works on Debian/Ubuntu); make check
  parses the spec when rpmspec is installed.
- Release workflow builds deb and rpm, attaches both, publishes the rpm
  to Gitea's RPM registry. Job renamed to 'packages'.
- pkg_install: install hints use dnf or apt with the right package
  names (doctor, fetch, python3/openssl checks).
- firewalld: new prints the firewall-cmd command for its port; doctor
  lists instance and daemon ports firewalld doesn't allow.
- Docs, README, AGENTS.md and changelog; VERSION 0.0.13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/terractl-remote

@@ -238,7 +238,8 @@ def ensure_cert():
                  "-keyout", new_key, "-out", new_crt],
                 stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
         except OSError:
-            die("openssl is not installed (sudo apt install openssl)")
+            manager = "dnf" if shutil.which("dnf") and not shutil.which("apt-get") else "apt"
+            die(f"openssl is not installed (sudo {manager} install openssl)")
         finally:
             os.umask(old_umask)
         if proc.returncode != 0: