LKMA-203 deploy runbook updates

[nicolasumaras]

Summary

• Document Debian Bookworm packages for the SpanDSP worker, pppd, nftables, and iptables-nft fallback
• Install the built softmodem worker to /opt/sipfax/bin/sipfax-softmodem and align PPP hook paths with /etc/ppp/ip-up.d/sipfax and /etc/ppp/ip-down.d/sipfax
• Document per-call chap-secrets/pap-secrets lifecycle plus operator verification commands for systemd, /healthz, pppd, nftables, and media.modem
• Add deploy asset tests covering the runbook and installer expectations

Verification

• node --test test/deploy-assets.test.js
• bash -n deploy/install-systemd.sh

Issue: LKMA-203

[nicolasumaras]

Reviewer verdict: APPROVE on head d361ce4.

(Posting as a comment rather than a review because GitHub blocks self-approval on this repo — the PR author and reviewer share a git identity.)

Verified against LKMA-203 deliverables:

• Bookworm apt section installs libspandsp2 + libspandsp-dev + build-essential + pkg-config + python3 + ppp + nftables + iptables, with rationale.
• /opt/sipfax/bin/sipfax-softmodem install in install-systemd.sh creates the dir 0755 root:sipfax and installs the binary 0755 root:sipfax; installer aborts cleanly if the vendored binary is missing.
• pppd hooks installed at /etc/ppp/ip-up.d/sipfax and /etc/ppp/ip-down.d/sipfax with the privilege boundary called out for Operator review.
• chap-secrets/pap-secrets per-call 0600 lifecycle documented in both runbook and sipfax.env.example.
• All five verification commands present: systemctl status sipfax, curl /healthz, pppd --version, nft list ruleset | head, and jq '.media.modem' control-fd snapshot.

Independent checks on the exact PR head:

• bash -n deploy/install-systemd.sh: OK.
• node --test test/deploy-assets.test.js: 5/5 pass.
• GitHub CI 'test' check: SUCCESS.
• mergeStateStatus: CLEAN, mergeable: MERGEABLE.

Merging now.