feat: add Arch Linux package (PKGBUILD, systemd service, sysusers)

- PKGBUILD for building the package
- Systemd service with CAP_NET_BIND_SERVICE for port 53
- sysusers.d config to create doh-forwarder system user
- Default config at /etc/doh-forwarder/config.toml

pkg/arch/doh-forwarder.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=DoH Forwarder - DNS-over-HTTPS forwarder
+Documentation=https://gitea.logi.camp/LogiCrew/doh-forwarder
+After=network.target
+
+[Service]
+Type=simple
+User=doh-forwarder
+Group=doh-forwarder
+ExecStart=/usr/bin/doh-forwarder --config /etc/doh-forwarder/config.toml
+Restart=on-failure
+RestartSec=5
+
+# Allow binding to port 53 without root
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ReadWritePaths=/var/lib/doh-forwarder
+
+[Install]
+WantedBy=multi-user.target