fix(packaging): make .deb install and upgrade actually work end-to-end

- Generate internal CA + CA-signed web TLS cert in postinst (port 443 was
  falling back to plain HTTP because no cert files existed)
- Repair stale sqlx migration checksums for upgrades from <= 1.1.7
- Restore health check as advisory only (never fails the install)
- Use runuser instead of sudo (sudo is not guaranteed on minimal images)
- Replace predictable /tmp password file with mktemp under /run
- Frontend assets root-owned read-only (security)
- Drop Pre-Depends: postgresql-16 (misuse); drop argon2 dep (unused)
- Add openssl, curl, cron, util-linux as proper dependencies

debian/changelog

@@ -1,3 +1,9 @@
+linux-patch-manager (1.1.13-1) unstable; urgency=low
+
+  * Release v1.1.13
+
+ -- git-echo <git-echo@moon-dragon.us>  Wed, 10 Jun 2026 09:16:34 -0500
+
 linux-patch-manager (1.1.12-1) unstable; urgency=low
 
   * Release v1.1.12