V1.0: Class 1 fax — real-world 4-page send to external number confirmed

Core features:
- Class 1 T.30 protocol: full send/receive implementation
- HDLC: DLE-stuffing, FCS strip, USR5637 bit-reversal handling
- T.4 MH encoder/decoder (1728px A4 standard)
- Document pipeline: PDF (Ghostscript), PNG, TIFF input
- Width clamping: US Letter 1734px → 1728px fax standard
- Cover page: CJK rasterization (TW/CN/JP/EN), TIFF + HTML output
- OCR verification: Tesseract 5 with eng+chi_tra, CJK space-tolerant
- API server (axum): health, send, jobs, cover, retry, cancel
- Background worker: auto-poll queue, speed fallback, retry policy
- Modem detection, pool management

Real-world test results (2026-07-23):
- V90 → 25153038: 4 pages, V.17 12000 bps, 2:33 ✅
- USR5637 → 25153038: 4 pages, V.17 12000 bps, 2:26 ✅
- Both faxes confirmed received on remote machine

Tested: loopback (100% pixel match), multi-page, all input formats,
cover pages, OCR verify, API endpoints, worker processing.
13 unit tests pass, 0 new clippy warnings.

deployment/telfax.service

@@ -0,0 +1,45 @@
+[Unit]
+Description=Telfax Enterprise Fax Server
+After=network.target
+Documentation=https://github.com/yourorg/telfax
+
+[Service]
+Type=simple
+User=telfax
+Group=telfax
+WorkingDirectory=/opt/telfax
+ExecStart=/opt/telfax/bin/telfax serve --config /opt/telfax/config.toml
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=30
+TimeoutStopSec=30
+
+# Logging to systemd journal
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=telfax
+
+# Environment
+Environment=RUST_LOG=info
+Environment=TELFAX_CONFIG_PATH=/opt/telfax/config.toml
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+PrivateTmp=true
+
+# Allow write access to necessary directories
+ReadWritePaths=/opt/telfax
+ReadWritePaths=/var/lib/telfax
+ReadWritePaths=/var/log/telfax
+ReadWritePaths=/dev
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target