Сборка: добавить production packaging flow через .deb

Добавлен package-режим в tools/build.sh: --package, --dist-dir, --version. Реализована сборка Debian-пакета, metadata/control, postinst/postrm и SHA256SUMS. Установочные пути унифицированы под /usr/sbin и /lib/systemd/system для production-модели.

docs/IMPLEMENTATION_SPEC.md

@@ -26,7 +26,7 @@ It does not replace Amnezia. It controls the surrounding system state that the o
 One systemd service runs:
 
 ```bash
-/usr/local/bin/awg2-harness daemon --config /etc/awg2-harness/config.toml
+/usr/sbin/awg2-harness daemon --config /etc/awg2-harness/config.toml
 ```
 
 The daemon starts as root and keeps running. On startup it performs initial reconcile. During runtime it reacts to Docker events and also runs a periodic reconcile loop.
@@ -311,7 +311,7 @@ table inet awg2_harness {
 
 Target namespace: the same Amnezia network namespace where `tc` shaping is applied. Do not assume the initial host namespace sees original peer source addresses. If Amnezia performs NAT inside the container namespace, the host Docker bridge may only see the container address, not `10.8.1.x`.
 
-Default threshold: `200` concurrent flows per peer IP. `250` is the conservative compatibility setting if there are complaints from unusually connection-heavy WebSocket/WebRTC/trading-browser workloads. `150` is more aggressive and should only be used after real traffic observation.
+Default threshold: `100` concurrent flows per peer IP. `150` is the conservative compatibility setting if there are complaints from unusually connection-heavy WebSocket/WebRTC/trading-browser workloads. `70` is more aggressive and should only be used after real traffic observation.
 
 Rule placement: use `forward` hook with priority `filter` or any priority after conntrack lookup. Restrict evaluation to `ct state new` so established flows continue normally and only new flow attempts beyond the threshold are dropped.