feat: ESLint, shell completions, Docker, nfpm packaging, CI/CD

- ESLint with typescript-eslint + prettier (eslint.config.js)
- Shell completions for bash and fish (scripts/generate-completions.ts)
- Multi-stage Dockerfile for bastion (fedora:43 + dnsmasq + node)
- nfpm.yaml for RPM/DEB packaging with bun-compiled binary
- Build scripts: build-rpm.sh, build-bastion.sh, publish-rpm/deb.sh
- Gitea Actions CI/CD: lint, typecheck, test, build, publish

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/stack/Dockerfile

@@ -1,3 +1,28 @@
+# Stage 1: Build TypeScript
+FROM node:22-alpine AS builder
+
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+
+WORKDIR /app
+
+# Copy workspace config and package manifests
+COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json tsconfig.json ./
+COPY src/shared/package.json src/shared/tsconfig.json src/shared/
+COPY src/bastion/package.json src/bastion/tsconfig.json src/bastion/
+COPY src/cli/package.json src/cli/tsconfig.json src/cli/
+
+# Install all dependencies
+RUN pnpm install --frozen-lockfile
+
+# Copy source code
+COPY src/shared/src/ src/shared/src/
+COPY src/bastion/src/ src/bastion/src/
+COPY src/cli/src/ src/cli/src/
+
+# Build TypeScript
+RUN pnpm build
+
+# Stage 2: Production runtime
 FROM fedora:43
 
 # Install system dependencies
@@ -7,21 +32,29 @@ RUN dnf install -y \
     ipxe-bootimgs-aarch64 \
     curl \
     openssh-clients \
+    nodejs \
+    npm \
     && dnf clean all
 
-# Install Node.js 22
-RUN dnf install -y nodejs npm && dnf clean all
+# Install pnpm
 RUN npm install -g pnpm@9
 
 # Create app directory
 WORKDIR /app
 
-# Copy package files and install dependencies
-COPY package.json pnpm-lock.yaml* ./
-RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install
+# Copy workspace config, manifests, and lockfile
+COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
+COPY src/shared/package.json src/shared/
+COPY src/bastion/package.json src/bastion/
+COPY src/cli/package.json src/cli/
 
-# Copy built application
-COPY dist/ ./dist/
+# Install production dependencies
+RUN pnpm install --frozen-lockfile --prod 2>/dev/null || pnpm install --prod
+
+# Copy built output from builder
+COPY --from=builder /app/src/shared/dist/ src/shared/dist/
+COPY --from=builder /app/src/bastion/dist/ src/bastion/dist/
+COPY --from=builder /app/src/cli/dist/ src/cli/dist/
 
 # Create data directories
 RUN mkdir -p /data/state /data/tftp /data/http
@@ -34,4 +67,4 @@ EXPOSE 67/udp
 EXPOSE 69/udp
 EXPOSE 4011/udp
 
-ENTRYPOINT ["node", "dist/cli/index.js", "serve"]
+ENTRYPOINT ["node", "src/cli/dist/index.js", "init", "bastion", "standalone", "start"]