feat: Add ISO build system with preseed configuration

Adds ISO creation capability for bare metal deployment:
- preseed.cfg: Debian installer automation file
  - Automates all installation steps
  - User only sets username/password, root password, target disk
  - Installs minimal package set
- build-iso.sh: Docker-based ISO build script
  - Downloads Debian 13 netboot ISO
  - Extracts ISO contents
  - Injects preseed configuration
  - Creates custom football-installer.iso
  - All work done in Docker container

ISO enables easy bare metal deployment with minimal user input.

💘 Generated with Crush

Assisted-by: Gemini 2.5 Flash via Crush <crush@charm.land>

config/preseed.cfg

@@ -0,0 +1,91 @@
+# Debian Preseed Configuration for Football System
+# This preseed file answers most questions automatically
+# User only needs to set: username/password, root password, target disk
+
+# Locale
+d-i debian-installer/locale string en_US.UTF-8
+d-i keyboard-configuration/xkb-keymap select us
+
+# Network configuration (DHCP - will be reconfigured later)
+d-i netcfg/choose_interface select auto
+d-i netcfg/get_hostname string football
+d-i netcfg/get_domain string localdomain
+
+# Mirror configuration
+d-i mirror/country string manual
+d-i mirror/http/hostname string deb.debian.org
+d-i mirror/http/directory string /debian
+d-i mirror/http/proxy string
+
+# Clock and timezone
+d-i clock-setup/utc boolean true
+d-i time/zone string UTC
+
+# Partitioning (User selects disk, we handle the rest)
+d-i partman-auto/method string lvm
+d-i partman-lvm/device_remove_lvm boolean true
+d-i partman-lvm/confirm boolean true
+d-i partman/choose_partition select finish
+d-i partman/confirm boolean true
+d-i partman/confirm_nooverwrite boolean true
+
+# LVM setup
+d-i partman-auto-lvm/guided_size string max
+
+# Base system installation
+d-i base-installer/kernel/image string linux-image-amd64
+
+# Account setup (User will provide these)
+d-i passwd/user-fullname string Football User
+d-i passwd/username string user
+d-i passwd/user-password password changeme
+d-i passwd/user-password-again password changeme
+d-i passwd/root-password password changeme
+d-i passwd/root-password-again password changeme
+
+# User is not sudo by default - will be configured later
+d-i passwd/user-default-groups string audio,dialout,video
+
+# Package selection - Minimal system
+tasksel tasksel/first multiselect standard
+
+# Individual packages to install
+d-i pkgsel/include string \
+    openssh-server \
+    wireguard \
+    wireguard-tools \
+    vim \
+    less \
+    bash-completion \
+    iproute2 \
+    iputils-ping \
+    curl \
+    wget \
+    rsync \
+    aide \
+    auditd \
+    rsyslog \
+    logrotate \
+    grub-efi-amd64 \
+    grub-efi-amd64-bin \
+    efibootmgr \
+    dosfstools \
+    parted \
+    fdisk \
+    sudo
+
+# Boot loader
+d-i grub-installer/bootdev string default
+d-i grub-installer/only_debian boolean true
+d-i grub-installer/with-other-os boolean true
+
+# Finish the installation
+d-i finish-install/keep-consoles boolean true
+d-i finish-install/reboot_in_progress note
+
+# Prevent package questions during install
+d-i preseed/late_command string \
+    in-target chmod 755 /home/user && \
+    in-target chown -R user:user /home/user
+
+# Security configuration will be applied post-install via harden.sh