feat(deploy): TrueNAS Custom-App + Auto-Deploy, plus aufgelaufene Arbeit

Deployment:
- custom-app.compose.yaml: self-contained Compose fuer TrueNAS "Custom App"
  (absolute Host-Bind-Pfade, postgres:18, pull_policy always, Port 8090)
- scripts/truenas-deploy.sh: Host-Skript create/redeploy via midclt (App
  bleibt unter Apps sichtbar) inkl. Image-Pull + Health-Check
- ci.yml Deploy-Job: laeuft auf ubuntu-latest-Runner, kopiert Deploy-Dateien
  per SSH auf den NAS-Host und triggert truenas-deploy.sh (statt runs-on goldeye)
- compose.yaml/.env.example: postgres:18 (Locale-Match zur Quell-DB), Port 8090
- .gitignore: .agents/, tools/rag/, deploy/truenas/.env (Secrets/Scratch)

Aufgelaufene Feature-Arbeit (verified/Freeze, Migrationen, Import-Triage):
- GerbilOverride/VerifiedGerbil-Endpoints + GerbilSnapshotService + Tests
- EF-Migrationen (ShowInChronicle, Stillborn, BirthOrder, ManualFlag, DSGVO)
- Frontend VerifizierteTierePage + verified-API + e2e-Spec
- diverse Import-/Triage-Skripte und -Tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -23,6 +23,10 @@ on:
   pull_request:
     branches:
       - main
+  # Manueller „Run workflow"-Button in Gitea: testet, baut, pusht und deployt frisch.
+  # Fuer einen Rollback auf ein altes Image stattdessen auf der NAS:
+  #   TAG=<git-sha> sh /opt/gerbilmanager/deploy/truenas/scripts/deploy.sh
+  workflow_dispatch:
 
 env:
   REGISTRY: git.rismer.de
@@ -100,7 +104,7 @@ jobs:
     name: Docker Build & Push
     runs-on: ubuntu-latest
     needs: [test-backend, test-frontend]
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     steps:
       - uses: actions/checkout@v4
 
@@ -133,3 +137,46 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.REGISTRY_OWNER }}/gerbilmanager-frontend:latest
             ${{ env.REGISTRY }}/${{ env.REGISTRY_OWNER }}/gerbilmanager-frontend:${{ github.sha }}
+
+  deploy:
+    name: Deploy auf TrueNAS (Custom App)
+    # Laeuft auf dem vorhandenen containerisierten Gitea-Runner (Label ubuntu-latest).
+    # Der Runner hat KEINEN Host-Dateisystem-/midclt-Zugriff, daher: per SSH zum NAS-Host
+    # verbinden, die Deploy-Dateien nach /opt/gerbilmanager kopieren und dort
+    # truenas-deploy.sh ausfuehren (legt die TrueNAS "Custom App" an bzw. rollt sie neu
+    # aus via `midclt` — die App bleibt unter Apps sichtbar).
+    #
+    # Benoetigte Repo-Secrets (Gitea -> Einstellungen -> Actions -> Secrets):
+    #   NAS_SSH_HOST  z. B. 192.168.2.115  (Host-LAN-IP der NAS)
+    #   NAS_SSH_KEY   privater SSH-Deploy-Key (Pubkey liegt in /root/.ssh/authorized_keys)
+    runs-on: ubuntu-latest
+    needs: [build-and-push]
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: SSH-Client + Key einrichten
+        run: |
+          command -v ssh >/dev/null 2>&1 || (apt-get update && apt-get install -y --no-install-recommends openssh-client rsync)
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "${{ secrets.NAS_SSH_KEY }}" > ~/.ssh/id_deploy
+          chmod 600 ~/.ssh/id_deploy
+          ssh-keyscan -H "${{ secrets.NAS_SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Deploy-Dateien auf den NAS-Host kopieren
+        run: |
+          NAS="root@${{ secrets.NAS_SSH_HOST }}"
+          SSH="ssh -i ~/.ssh/id_deploy -o StrictHostKeyChecking=accept-new"
+          $SSH "$NAS" 'mkdir -p /opt/gerbilmanager/deploy/truenas/scripts'
+          rsync -az -e "$SSH" \
+            deploy/truenas/custom-app.compose.yaml \
+            "$NAS":/opt/gerbilmanager/deploy/truenas/
+          rsync -az -e "$SSH" \
+            deploy/truenas/scripts/ \
+            "$NAS":/opt/gerbilmanager/deploy/truenas/scripts/
+
+      - name: Custom App neu ausrollen (midclt create/redeploy + Health-Check)
+        run: |
+          NAS="root@${{ secrets.NAS_SSH_HOST }}"
+          ssh -i ~/.ssh/id_deploy -o StrictHostKeyChecking=accept-new "$NAS" \
+            "sh /opt/gerbilmanager/deploy/truenas/scripts/truenas-deploy.sh"