Harden Lenovo T480 with Debian

I have a Lenovo ThinkPad T480 waiting for a fresh, security-first Debian installation. The goal is a fully hardened, privacy-respecting daily-driver that ships with BOTH Mozilla Firefox and Brave, each pre-tuned for strong tracking-protection and fingerprint-resistance.

This is an ADVANCED hardening job. Beyond the base install I’ll need full-disk LUKS2 encryption, secure boot/Libreboot if the hardware permits, locked-down BIOS settings, kernel and sysctl tweaks, AppArmor (or comparable MAC), DNS proxy with encrypted queries, and a firewall configured to best practice levels. I did not select a specific firewall in the form, so feel free to recommend whether UFW, iptables or firewalld is the right fit for an always-on laptop that roams between trusted and untrusted networks.

Deliverables I will sign off on:
• Debian (stable or testing – your call with rationale) installed and fully updated
• Libreboot or equivalent coreboot/firmware hardening applied, with clear notes if any T480 limitations arise
• Firefox and Brave installed and hardened (add-ons, about:config, Brave Shields settings documented)
• Encrypted DNS proxy running system-wide
• Firewall ruleset active on all interfaces, tuned for laptop mobility
• Ports closed by default
• Written summary of every change, commands issued, and how I can maintain or roll back each tweak

I’ll handle shipping; just let me know your preferred method.