feat: ESLint, shell completions, Docker, nfpm packaging, CI/CD

- ESLint with typescript-eslint + prettier (eslint.config.js)
- Shell completions for bash and fish (scripts/generate-completions.ts)
- Multi-stage Dockerfile for bastion (fedora:43 + dnsmasq + node)
- nfpm.yaml for RPM/DEB packaging with bun-compiled binary
- Build scripts: build-rpm.sh, build-bastion.sh, publish-rpm/deb.sh
- Gitea Actions CI/CD: lint, typecheck, test, build, publish

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/package.json

@@ -10,7 +10,10 @@
     "test:run": "vitest run",
     "typecheck": "tsc --build",
     "clean": "pnpm -r run clean && rimraf node_modules",
-    "lint": "eslint 'src/*/src/**/*.ts'"
+    "lint": "eslint 'src/*/src/**/*.ts'",
+    "lint:fix": "eslint 'src/*/src/**/*.ts' --fix",
+    "completions:generate": "tsx scripts/generate-completions.ts --write",
+    "completions:check": "tsx scripts/generate-completions.ts --check"
   },
   "engines": {
     "node": ">=20.0.0",
@@ -19,6 +22,10 @@
   "packageManager": "pnpm@9.15.0",
   "devDependencies": {
     "@types/node": "^22.10.0",
+    "@typescript-eslint/eslint-plugin": "^8.57.1",
+    "@typescript-eslint/parser": "^8.57.1",
+    "eslint": "^10.0.3",
+    "eslint-config-prettier": "^10.1.8",
     "rimraf": "^6.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.7.0",