feat: create epithet service user automatically on pkg install

Add pre-install script to +MANIFEST that creates the epithet user
via pw(8) if it doesn't already exist. Tested on FreeBSD 15.0.

Author: brianm

contrib/freebsd/+MANIFEST

@@ -15,3 +15,8 @@ key-based authentication with short-lived certificates (2-10 minutes).
 It provides CA, policy, and combined server modes in a single binary,
 with OIDC-based authentication and per-connection SSH agents.
 EOD
+scripts: {
+  pre-install: <<EOD
+pw usershow epithet >/dev/null 2>&1 || pw useradd epithet -d /nonexistent -s /usr/sbin/nologin -c "epithet CA"
+EOD
+}

contrib/freebsd/README.md

@@ -38,9 +38,8 @@ pkg add ./epithet-*.pkg
    vi /usr/local/etc/epithet/server.yaml
    ```
 
-3. Create a service user:
+3. Set CA key ownership (the `epithet` user is created automatically during install):
    ```sh
-   pw useradd epithet -d /nonexistent -s /usr/sbin/nologin -c "epithet CA"
    chown epithet /usr/local/etc/epithet/ca.key
    ```