Add ngx_http_ipng_stats_module: per-VIP, per-device traffic counters

Full implementation of the nginx dynamic module with:
- SO_BINDTODEVICE-based per-interface traffic attribution
- Per-worker lock-free counters flushed to shared memory
- Prometheus text and JSON scrape endpoint at configurable location
- UDP-only global logtail (ipng_stats_logtail) for fire-and-forget
  access log streaming
- $ipng_source_tag nginx variable for use in log_format/map
- Histogram buckets, EWMA rate gauges, zone meta-metrics
- Debian packaging (libnginx-mod-http-ipng-stats)
- Robot Framework end-to-end tests via containerlab
- SPDX Apache-2.0 headers on all source files

debian/control

@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: Apache-2.0
+Source: nginx-ipng-stats-plugin
+Section: httpd
+Priority: optional
+Maintainer: Pim van Pelt <pim@ipng.ch>
+Build-Depends:
+ debhelper-compat (= 13),
+ nginx-dev,
+ libpcre2-dev,
+ zlib1g-dev,
+ libssl-dev
+Standards-Version: 4.6.2
+Homepage: https://git.ipng.ch/ipng/nginx-ipng-stats-plugin
+Rules-Requires-Root: no
+
+Package: libnginx-mod-http-ipng-stats
+Architecture: any
+Depends:
+ ${misc:Depends},
+ ${shlibs:Depends},
+ nginx (>= 1.26~)
+Description: nginx dynamic module for per-VIP, per-device traffic counters
+ This package ships ngx_http_ipng_stats_module as a dynamic module
+ loadable into stock upstream nginx on Debian. The module records
+ per-VIP HTTP request counters, status code distribution, bytes in
+ and out, and request-duration histograms, and attributes each
+ request to the interface it arrived on. Counters are exposed as
+ Prometheus text and JSON from a single scrape endpoint.
+ .
+ Attribution is done by the Linux kernel's TCP socket lookup, using
+ SO_BINDTODEVICE on per-interface listening sockets. The module adds
+ device= and ipng_source_tag= parameters to the nginx listen
+ directive; the kernel routes each incoming connection to the
+ correct listener by ingress interface.
+ .
+ Typical use cases include GRE tunnel fleets, VLAN trunks, or any
+ deployment where traffic arrives on distinct interfaces and
+ per-interface observability is needed.