feat: add bump-version.sh script for version management

Automates version bumps across all version source files:
- Cargo.toml (PRIMARY - workspace.package.version)
- debian/changelog (prepend new entry)
- debian/control (update Version field)
- scripts/build-package.sh (update VERSION variable)
- frontend/package.json (update version field)
- Stale references check after bump

Usage: ./scripts/bump-version.sh <new_version> <old_version>

systemd/patch-manager-web.service

@@ -0,0 +1,61 @@
+[Unit]
+Description=Linux Patch Manager — Web Server
+Documentation=https://gitea.moon-dragon.us/echo/linux_patch_manager
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+PartOf=patch-manager.target
+
+[Service]
+Type=simple
+User=patch-manager
+Group=patch-manager
+WorkingDirectory=/opt/patch-manager
+
+# Configuration
+Environment="PATCH_MANAGER_CONFIG=/etc/patch-manager/config.toml"
+# Override individual settings via environment if needed:
+# Environment="PATCH_MANAGER__DATABASE__URL=postgres://..."
+
+ExecStart=/usr/local/bin/pm-web
+
+# Restart policy — aggressive restart for production availability
+Restart=always
+RestartSec=5s
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+# Timeouts
+TimeoutStartSec=90s
+TimeoutStopSec=30s
+
+# Watchdog disabled — pm-web does not currently implement sd_notify
+# WatchdogSec=120s
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/log/patch-manager /etc/patch-manager/ca /etc/patch-manager/certs /etc/patch-manager/tls /etc/patch-manager/jwt /usr/share/patch-manager/frontend
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+
+# Allow binding to port 443 without root
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# File descriptor limits
+LimitNOFILE=65536
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=patch-manager-web
+
+[Install]
+WantedBy=multi-user.target

systemd/patch-manager-worker.service

@@ -0,0 +1,57 @@
+[Unit]
+Description=Linux Patch Manager — Background Worker
+Documentation=https://gitea.moon-dragon.us/echo/linux_patch_manager
+After=network-online.target postgresql.service patch-manager-web.service
+Wants=network-online.target
+Requires=postgresql.service
+# Worker waits for the web process to apply migrations before starting tasks
+Wants=patch-manager-web.service
+PartOf=patch-manager.target
+
+[Service]
+Type=simple
+User=patch-manager
+Group=patch-manager
+WorkingDirectory=/opt/patch-manager
+
+# Configuration
+Environment="PATCH_MANAGER_CONFIG=/etc/patch-manager/config.toml"
+
+ExecStart=/usr/local/bin/pm-worker
+
+# Restart policy — aggressive restart for production availability
+Restart=always
+RestartSec=10s
+StartLimitIntervalSec=120
+StartLimitBurst=5
+
+# Timeouts — worker may take longer to drain active jobs
+TimeoutStartSec=120s
+TimeoutStopSec=120s
+
+# Watchdog disabled — pm-worker does not currently implement sd_notify
+# WatchdogSec=180s
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/log/patch-manager /etc/patch-manager/ca /etc/patch-manager/certs /etc/patch-manager/tls /etc/patch-manager/jwt
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+
+# File descriptor limits
+LimitNOFILE=65536
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=patch-manager-worker
+
+[Install]
+WantedBy=multi-user.target

systemd/patch-manager.target

@@ -0,0 +1,7 @@
+[Unit]
+Description=Linux Patch Manager — Service Target
+Documentation=https://gitea.moon-dragon.us/echo/linux_patch_manager
+Wants=patch-manager-web.service patch-manager-worker.service
+
+[Install]
+WantedBy=multi-user.target