Add ngx_http_ipng_stats_module: per-VIP, per-device traffic counters

Full implementation of the nginx dynamic module with:
- SO_BINDTODEVICE-based per-interface traffic attribution
- Per-worker lock-free counters flushed to shared memory
- Prometheus text and JSON scrape endpoint at configurable location
- UDP-only global logtail (ipng_stats_logtail) for fire-and-forget
  access log streaming
- $ipng_source_tag nginx variable for use in log_format/map
- Histogram buckets, EWMA rate gauges, zone meta-metrics
- Debian packaging (libnginx-mod-http-ipng-stats)
- Robot Framework end-to-end tests via containerlab
- SPDX Apache-2.0 headers on all source files

debian/rules

@@ -0,0 +1,39 @@
+#!/usr/bin/make -f
+# SPDX-License-Identifier: Apache-2.0
+# debian/rules for nginx-ipng-stats-plugin
+#
+# The actual module build is driven by the top-level Makefile, which
+# copies /usr/share/nginx/src (from nginx-dev) into a writable
+# build/nginx-src/ and runs the out-of-tree --add-dynamic-module dance
+# against it. debian/rules just delegates to `make build` and installs
+# the resulting .so into the package tree.
+
+export DH_VERBOSE = 1
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+
+MODULE_NAME := ngx_http_ipng_stats_module
+PKG         := libnginx-mod-http-ipng-stats
+
+%:
+	dh $@
+
+override_dh_auto_configure:
+	# No-op: configure happens inside `make build`.
+
+override_dh_auto_build:
+	$(MAKE) build
+
+override_dh_auto_install:
+	install -D -m 0644 \
+		$(CURDIR)/build/$(MODULE_NAME).so \
+		$(CURDIR)/debian/$(PKG)/usr/lib/nginx/modules/$(MODULE_NAME).so
+	install -D -m 0644 \
+		$(CURDIR)/debian/mod-http-ipng-stats.conf \
+		$(CURDIR)/debian/$(PKG)/etc/nginx/modules-available/50-mod-http-ipng-stats.conf
+
+override_dh_auto_clean:
+	# Preserve build/ across clean so dpkg-buildpackage doesn't force
+	# a full rebuild of the fetched nginx source tree every time. The
+	# top-level `make clean` will flush it when the user really wants
+	# a fresh start.
+	dh_auto_clean