Add a documentation website, built with Zola

The documentation moves from READMEs into a site in docs/: getting
started, a user guide, operations, a reference, and development pages,
written in the style of network vendors' documentation (docs/STYLE.md).
bin/bgp/README.md and docs/RFCs.md are folded into it.

- A theme of its own in the International Typographic Style, in blues,
  with self-hosted Inter and JetBrains Mono, search over Zola's index,
  dark mode, and no resources loaded from other hosts.
- Example configurations in docs/examples/, shown on the pages and
  checked with `bgp --check` in CI.
- A test that fails when a field of config.proto is missing from the
  configuration reference.
- A CI job that builds the site; Zola fails on broken links and anchors.
- A hardened systemd unit, tried under systemd with kernel routes on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/examples/ferrix.service

@@ -0,0 +1,52 @@
+# /etc/systemd/system/ferrix.service
+#
+# Runs the Ferrix daemon as an unprivileged user, with only the
+# capabilities that it requires, and restricts its access to the system.
+# The log is written to the journal: journalctl -u ferrix.
+[Unit]
+Description=Ferrix BGP daemon
+Documentation=https://ferrix.rayhaan.net/docs/
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=exec
+User=ferrix
+Group=ferrix
+# Validate the configuration before starting. An invalid configuration
+# prevents the start, and the error is written to the journal.
+ExecStartPre=/usr/local/bin/bgp --check /etc/ferrix/server.textpb
+ExecStart=/usr/local/bin/bgp /etc/ferrix/server.textpb --level info
+Restart=on-failure
+RestartSec=5s
+# Time to notify all neighbors and remove the kernel routes.
+TimeoutStopSec=30s
+
+# TCP port 179, and the kernel routing table.
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
+NoNewPrivileges=yes
+
+# BGP, RTR, HTTP, and netlink sockets only.
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target