chore: add Makefile and Debian packaging

packaging/DEBIAN/conffiles

@@ -0,0 +1 @@
+/etc/ezcoo-usb-control/config.yaml

packaging/DEBIAN/control

@@ -0,0 +1,14 @@
+Package: ezcoo-usb-control
+Version: VERSION_PLACEHOLDER
+Architecture: ARCH_PLACEHOLDER
+Maintainer: Oleksandr Berezovskyi <claude.ai@berezovskyi.dev>
+Depends: adduser
+Recommends: mosquitto-clients
+Description: MQTT bridge for EZCOO HDMI matrix switches
+ Controls an EZCOO EZ-MX42HAS-ARC (4-in 2-out) HDMI matrix via USB-UART
+ and exposes it to Home Assistant as two select entities through MQTT
+ auto-discovery.
+ .
+ Communicates with the matrix using the EZCOO ASCII serial protocol and
+ periodically polls routing state to detect external changes (front panel,
+ IR remote).

packaging/DEBIAN/postinst

@@ -0,0 +1,33 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # Create system user if it doesn't exist.
+        if ! id -u ezcoo > /dev/null 2>&1; then
+            adduser --system --no-create-home --shell /usr/sbin/nologin \
+                    --group --gecos "EZCOO HDMI matrix bridge" ezcoo
+        fi
+
+        # Ensure the user is in the dialout group for serial access.
+        if getent group dialout > /dev/null 2>&1; then
+            adduser ezcoo dialout
+        fi
+
+        # Lock down the config directory so only ezcoo can read credentials.
+        chown -R root:ezcoo /etc/ezcoo-usb-control
+        chmod 750 /etc/ezcoo-usb-control
+        chmod 640 /etc/ezcoo-usb-control/config.yaml
+        ;;
+esac
+
+if [ -d /run/systemd/system ]; then
+    systemctl daemon-reload
+    systemctl enable ezcoo-usb-control.service
+    # Only start automatically on fresh installs, not upgrades.
+    if [ "$1" = "configure" ] && [ -z "$2" ]; then
+        systemctl start ezcoo-usb-control.service || true
+    fi
+fi
+
+#DEBHELPER#

packaging/DEBIAN/postrm

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    purge)
+        rm -rf /etc/ezcoo-usb-control
+        if id -u ezcoo > /dev/null 2>&1; then
+            deluser --quiet ezcoo || true
+        fi
+        if getent group ezcoo > /dev/null 2>&1; then
+            delgroup --quiet ezcoo || true
+        fi
+        if [ -d /run/systemd/system ]; then
+            systemctl daemon-reload
+        fi
+        ;;
+esac
+
+#DEBHELPER#

packaging/DEBIAN/prerm

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove|upgrade|deconfigure)
+        if [ -d /run/systemd/system ]; then
+            systemctl stop ezcoo-usb-control.service || true
+            systemctl disable ezcoo-usb-control.service || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#

packaging/systemd/ezcoo-usb-control.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=EZCOO HDMI Matrix MQTT bridge
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ezcoo-usb-control --config /etc/ezcoo-usb-control/config.yaml
+Restart=on-failure
+RestartSec=5
+User=ezcoo
+SupplementaryGroups=dialout
+
+# Allow reading an optional environment file for secrets.
+# EnvironmentFile=-/etc/ezcoo-usb-control/env
+
+# Hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+DeviceAllow=char-ttyUSB rw
+DeviceAllow=char-ttyACM rw
+
+[Install]
+WantedBy=multi-user.target