addrkit: deterministic address resolution service (Go)

- domain: address normalization/parsing, matching with explicit statuses
- adapters: SQLite registry store, ArcGIS outages client, optional LLM rewriter, HTTP API
- seed pipeline with duplicate handling and unparsed reporting
- CLI (seed/verify/resolve), systemd unit, OpenAPI contract, tests

deploy/addrkitd.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=addrkit address resolution service
+Documentation=file:///opt/addrkit/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=lexicom
+Group=lexicom
+WorkingDirectory=/opt/addrkit
+# Environment carries the ${VAR} secrets referenced by config.json.
+EnvironmentFile=-/etc/addrkit/env
+ExecStart=/opt/addrkit/bin/addrkitd -config /opt/addrkit/config.json
+Restart=always
+RestartSec=5
+
+# Defence in depth: the service only reads its own directory.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadOnlyPaths=/opt/addrkit
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target