feat: ESLint, shell completions, Docker, nfpm packaging, CI/CD

- ESLint with typescript-eslint + prettier (eslint.config.js)
- Shell completions for bash and fish (scripts/generate-completions.ts)
- Multi-stage Dockerfile for bastion (fedora:43 + dnsmasq + node)
- nfpm.yaml for RPM/DEB packaging with bun-compiled binary
- Build scripts: build-rpm.sh, build-bastion.sh, publish-rpm/deb.sh
- Gitea Actions CI/CD: lint, typecheck, test, build, publish

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/scripts/build-bastion.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Build bastion container image and push to Gitea container registry
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+cd "$PROJECT_ROOT"
+
+# Load .env for GITEA_TOKEN
+if [ -f .env ]; then
+  set -a; source .env; set +a
+fi
+
+# Registry defaults to internal address (external proxy has body size limit)
+REGISTRY="${GITEA_REGISTRY:-mysources.co.uk}"
+IMAGE="lab-bastion"
+VERSION=$(node -p "require('./package.json').version")
+TAG="${1:-$VERSION}"
+
+echo "==> Building bastion image (tag: $TAG)..."
+podman build -t "$IMAGE:$TAG" -f stack/Dockerfile .
+
+echo "==> Tagging as $REGISTRY/michal/$IMAGE:$TAG..."
+podman tag "$IMAGE:$TAG" "$REGISTRY/michal/$IMAGE:$TAG"
+
+if [ -n "$GITEA_TOKEN" ]; then
+  echo "==> Logging in to $REGISTRY..."
+  podman login --tls-verify=false -u michal -p "$GITEA_TOKEN" "$REGISTRY"
+
+  echo "==> Pushing to $REGISTRY/michal/$IMAGE:$TAG..."
+  podman push --tls-verify=false "$REGISTRY/michal/$IMAGE:$TAG"
+
+  # Ensure package is linked to the repository
+  if [ -f "$SCRIPT_DIR/link-package.sh" ]; then
+    source "$SCRIPT_DIR/link-package.sh"
+    link_package "container" "$IMAGE"
+  fi
+else
+  echo "==> GITEA_TOKEN not set, skipping push."
+fi
+
+echo "==> Done!"
+echo "    Image: $REGISTRY/michal/$IMAGE:$TAG"