Pools, CLI, versioning, Debian packaging, HTTPS fix

- Replaced flat `backends: [...]` list on frontends with an ordered `pools:`
  list; each pool has a name and a map of backends with per-pool weights (0–100,
  default 100). Pools express priority: first pool with a healthy backend wins.
- Removed global backend weight (was on the backend, now lives in the pool).
- Config validation enforces non-empty pools, non-empty pool names, weight
  range, and consistent address families across all pools of a frontend.

- Added `PoolBackendInfo { name, weight }` and changed `PoolInfo.backends` from
  `repeated string` to `repeated PoolBackendInfo` so weights are visible over
  the API.

- Full interactive shell with readline, tab completion, and `?` inline help.
- Command tree parser (Walk) handles fixed keywords and dynamic slot nodes;
  prefix matching with exact-match priority.
- Commands: `show version/frontends/frontend/backends/backend/healthchecks/
  healthcheck`, `set backend <name> pause|resume`, `quit`/`exit`.
- `show frontend` output is hierarchical (pools → backends) with per-backend
  weights and `[disabled]` notation; pool section uses fixed-width formatting
  so ANSI color codes don't corrupt tabwriter alignment.
- `-color` flag (default true) wraps static field labels in dark-blue ANSI;
  works correctly with tabwriter because all labels carry identical-length
  escape sequences.

- `cmd/version.go` package holds `version`, `commit`, `date` vars set at build
  time via `-ldflags -X`.
- `make build` / `make build-amd64` / `make build-arm64` all inject
  `VERSION=0.1.1`, `COMMIT_HASH` (from `git rev-parse --short HEAD`), and
  `DATE` (UTC ISO-8601).
- `maglevc` prints version on interactive startup and exposes `show version`.
- `maglevd` logs version/commit/date at startup; `-version` flag prints and exits.

- `doHTTPProbe` was building a `https://` target URL even though TLS was already
  applied to the connection inside `inNetns`. `http.Transport` then wrapped the
  connection in a second TLS layer, producing "http: server gave HTTP response
  to HTTPS client". Fixed by always using `http://` in the target URL.
- Added `TestHTTPSProbe` using `httptest.NewTLSServer` to cover the full path.

- New `docs/user-guide.md`: maglevd flags/signals, maglevc commands, shell
  completion, and command-tree parser walkthrough.
- New `docs/healthchecks.md`: state machine, rise/fall model, probe intervals,
  all transition events with log examples.
- Updated `docs/config-guide.md`: pools design, removed global weight from
  backends, updated all examples.
- Updated `README.md`: packaging table, build paths, corrected binary locations
  (`/usr/sbin/maglevd`), config filename (`.yaml`).

- `debian/` directory contains `control.in`, `maglevd.service`, `default.maglev`,
  `maglev.yaml` (example config), `conffiles`, `postinst`, `prerm`.
- `debian/build-deb.sh` stages a package tree and calls `dpkg-deb`; emits
  `build/vpp-maglev_<version>~<commit>_<arch>.deb`.
- Cross-compiles for amd64 and arm64 in one `make pkg-deb` invocation.
- `maglevd` installed to `/usr/sbin/`, `maglevc` to `/usr/bin/`.
- Service reads `MAGLEV_CONFIG` from `/etc/default/maglev`
  (default: `/etc/maglev/maglev.yaml`).
- Man pages `maglevd(8)` and `maglevc(1)` live in `docs/` and are gzip'd into
  the package.
- All build output goes to `build/<arch>/`; `build/` is gitignored.

internal/config/config.go

@@ -67,16 +67,26 @@ type Backend struct {
 	Address     net.IP
 	HealthCheck string // name reference into Config.HealthChecks; "" = no probing, assume healthy
 	Enabled     bool   // default true; false = exclude from serving entirely
-	Weight      int    // 0-100, default 100
+}
+
+// PoolBackend is a backend reference within a pool, with pool-local weight.
+type PoolBackend struct {
+	Weight int // 0-100, default 100
+}
+
+// Pool is an ordered tier of backends within a frontend.
+type Pool struct {
+	Name     string
+	Backends map[string]PoolBackend // keyed by backend name
 }
 
 // Frontend is a single virtual IP entry.
 type Frontend struct {
 	Description string
 	Address     net.IP
-	Protocol    string   // "tcp", "udp", or "" (all traffic)
-	Port        uint16   // 0 means omitted (all ports)
-	Backends    []string // backend names, each must exist in Config.Backends
+	Protocol    string // "tcp", "udp", or "" (all traffic)
+	Port        uint16 // 0 means omitted (all ports)
+	Pools       []Pool // ordered tiers; first pool with any up backend is active
 }
 
 // ---- raw YAML types --------------------------------------------------------
@@ -127,15 +137,23 @@ type rawBackend struct {
 	Address     string `yaml:"address"`
 	HealthCheck string `yaml:"healthcheck"`
 	Enabled     *bool  `yaml:"enabled"` // nil → default true
-	Weight      *int   `yaml:"weight"`  // nil → default 100
+}
+
+type rawPoolBackend struct {
+	Weight *int `yaml:"weight"` // nil → default 100
+}
+
+type rawPool struct {
+	Name     string                    `yaml:"name"`
+	Backends map[string]rawPoolBackend `yaml:"backends"`
 }
 
 type rawFrontend struct {
-	Description string   `yaml:"description"`
-	Address     string   `yaml:"address"`
-	Protocol    string   `yaml:"protocol"`
-	Port        uint16   `yaml:"port"`
-	Backends    []string `yaml:"backends"`
+	Description string    `yaml:"description"`
+	Address     string    `yaml:"address"`
+	Protocol    string    `yaml:"protocol"`
+	Port        uint16    `yaml:"port"`
+	Pools       []rawPool `yaml:"pools"`
 }
 
 // ---- Load ------------------------------------------------------------------
@@ -319,11 +337,6 @@ func convertBackend(name string, r *rawBackend, hcs map[string]HealthCheck) (Bac
 		Address:     ip,
 		HealthCheck: r.HealthCheck,
 		Enabled:     boolDefault(r.Enabled, true),
-		Weight:      intDefault(r.Weight, 100),
-	}
-
-	if b.Weight < 0 || b.Weight > 100 {
-		return Backend{}, fmt.Errorf("weight %d is out of range [0, 100]", b.Weight)
 	}
 
 	if b.HealthCheck != "" {
@@ -340,7 +353,6 @@ func convertFrontend(name string, r *rawFrontend, backends map[string]Backend) (
 		Description: r.Description,
 		Protocol:    r.Protocol,
 		Port:        r.Port,
-		Backends:    r.Backends,
 	}
 
 	ip := net.ParseIP(r.Address)
@@ -361,21 +373,38 @@ func convertFrontend(name string, r *rawFrontend, backends map[string]Backend) (
 		return Frontend{}, fmt.Errorf("protocol %q requires port to be set (1-65535)", r.Protocol)
 	}
 
-	if len(r.Backends) == 0 {
-		return Frontend{}, fmt.Errorf("backends must not be empty")
+	if len(r.Pools) == 0 {
+		return Frontend{}, fmt.Errorf("pools must not be empty")
 	}
 	var firstFamily int
-	for i, bName := range r.Backends {
-		b, ok := backends[bName]
-		if !ok {
-			return Frontend{}, fmt.Errorf("backends[%d] %q not defined", i, bName)
+	firstBackend := true
+	for pi, rp := range r.Pools {
+		if rp.Name == "" {
+			return Frontend{}, fmt.Errorf("pools[%d].name must not be empty", pi)
 		}
-		fam := ipFamily(b.Address)
-		if i == 0 {
-			firstFamily = fam
-		} else if fam != firstFamily {
-			return Frontend{}, fmt.Errorf("backends[%d] %q has different address family than backends[0]", i, bName)
+		if len(rp.Backends) == 0 {
+			return Frontend{}, fmt.Errorf("pool %q backends must not be empty", rp.Name)
 		}
+		pool := Pool{Name: rp.Name, Backends: make(map[string]PoolBackend, len(rp.Backends))}
+		for bName, rpb := range rp.Backends {
+			b, ok := backends[bName]
+			if !ok {
+				return Frontend{}, fmt.Errorf("pool %q backend %q not defined", rp.Name, bName)
+			}
+			fam := ipFamily(b.Address)
+			if firstBackend {
+				firstFamily = fam
+				firstBackend = false
+			} else if fam != firstFamily {
+				return Frontend{}, fmt.Errorf("pool %q backend %q has different address family than first backend", rp.Name, bName)
+			}
+			w := intDefault(rpb.Weight, 100)
+			if w < 0 || w > 100 {
+				return Frontend{}, fmt.Errorf("pool %q backend %q weight %d out of range [0, 100]", rp.Name, bName, w)
+			}
+			pool.Backends[bName] = PoolBackend{Weight: w}
+		}
+		fe.Pools = append(fe.Pools, pool)
 	}
 
 	return fe, nil