These points are all resolved by the default installer if you choose full-disk encryption:
- a state of the art encryption
- fully encrypted disk (including swap)
- a single password on boot for decryption
- automatic encryption on hibernate/suspend
There are two partitions:
/boot/ (sda1) is not encrypted, sda2 will be encrypted, an LVM group will be formed out of the created device, and this LVM group will then be split into
/home/ and the swap partition. This swap partition will then also be used for hibernation. Using just a single encrypted partition makes the necessity for only one password, at boot or resume time, trivial.
Unfortunately I could not find any documentation of this on the Debian wiki, but Archlinux has this article.
a second password to boot to a second valid OS for plausible deniability.
I do not know of a Linux solution for this. And no real solution anywhere that makes the denying look really plausible (in the sense that the "fake" system should look as if it was regularly used); but that part would rather belong to security.stackexchange, IMHO.