refactor: Restructure project for Docker compliance and documentation

- Move documentation to docs/ directory for better organization
- Add bin/ directory for utility scripts
- Add lib/ for shared library functions
- Update all build scripts to ensure strict Docker compliance
- Enhance AGENTS.md with Docker container requirements
- Create comprehensive compliance and security documentation
- Reorganize test suite with improved structure
- Remove obsolete Dockerfile and archive documentation
- Add final security compliance report

BREAKING CHANGE: Restructured project layout with moved documentation directories

💘 Generated with Crush

Assisted-by: GLM-4.6 via Crush <crush@charm.land>

config/hooks/live/firewall-setup.sh

@@ -2,10 +2,38 @@
 # Dynamic firewall setup hook
 set -euo pipefail
 
-# Install firewall setup script
-install -m 755 /usr/local/bin/firewall-setup.sh
+echo "Setting up firewall configuration..."
+
+# Load firewall setup functions from proper volume path
+# shellcheck source=/build/src/firewall-setup.sh
+source /build/src/firewall-setup.sh
+
+# Install nftables rules (default deny policy)
+cat >/etc/nftables.conf <<'EOF'
+#!/usr/sbin/nft -f
+# Default secure firewall rules for KNEL-Football
+flush ruleset
+
+table inet filter {
+    chain input {
+        type filter hook input priority 0; policy drop
+        iif lo accept comment "Accept loopback"
+        icmp type echo-request accept comment "Accept ping"
+    }
+    
+    chain forward {
+        type filter hook forward priority 0; policy drop
+    }
+    
+    chain output {
+        type filter hook output priority 0; policy drop
+        oif lo accept comment "Accept loopback"
+        icmp type echo-request accept comment "Allow ping"
+    }
+}
+EOF
 
 # Enable nftables service
 systemctl enable nftables
 
-echo "Firewall setup hook completed."
+echo "Firewall setup hook completed."