feat(deploy): TrueNAS Custom-App + Auto-Deploy, plus aufgelaufene Arbeit

Deployment:
- custom-app.compose.yaml: self-contained Compose fuer TrueNAS "Custom App"
  (absolute Host-Bind-Pfade, postgres:18, pull_policy always, Port 8090)
- scripts/truenas-deploy.sh: Host-Skript create/redeploy via midclt (App
  bleibt unter Apps sichtbar) inkl. Image-Pull + Health-Check
- ci.yml Deploy-Job: laeuft auf ubuntu-latest-Runner, kopiert Deploy-Dateien
  per SSH auf den NAS-Host und triggert truenas-deploy.sh (statt runs-on goldeye)
- compose.yaml/.env.example: postgres:18 (Locale-Match zur Quell-DB), Port 8090
- .gitignore: .agents/, tools/rag/, deploy/truenas/.env (Secrets/Scratch)

Aufgelaufene Feature-Arbeit (verified/Freeze, Migrationen, Import-Triage):
- GerbilOverride/VerifiedGerbil-Endpoints + GerbilSnapshotService + Tests
- EF-Migrationen (ShowInChronicle, Stillborn, BirthOrder, ManualFlag, DSGVO)
- Frontend VerifizierteTierePage + verified-API + e2e-Spec
- diverse Import-/Triage-Skripte und -Tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

GerbilManagerWebAPI/Dtos/ApiDtos.cs

@@ -33,7 +33,8 @@ namespace GerbilManagerWebAPI.Dtos
         bool IsResident,
         string? ProfilePhotoUrl,
         bool IsCastrated,
-        string? Provenance);
+        string? Provenance,
+        int? BirthOrder = null);
 
     public record LitterDto(
         Guid Id,
@@ -41,11 +42,13 @@ namespace GerbilManagerWebAPI.Dtos
         DateOnly? Date,
         int? TotalBorn,
         int? DeathsWithin8Weeks,
+        int? Stillborn,
         Guid? FatherId,
         Guid? MotherId,
         DateOnly? ExpectedGoHomeDate,
         string? Notes,
-        string? Provenance);
+        string? Provenance,
+        bool ShowInChronicle);
 
     public record ContactDto(Guid Id, string Name, string? Email, string? Phone, string? Address, string? Notes, bool IsBreeder, bool IsReceiver, string? NameSuffix, string? Provenance);
 
@@ -65,8 +68,33 @@ namespace GerbilManagerWebAPI.Dtos
 
     public record PhotoDto(Guid Id, string FileName, string? Caption, int SortOrder, string Url);
 
+    // VERIFIED/PROTECTED OVERRIDE -------------------------------------------
+    // Status: "unchanged" = raw import agrees with the golden state; "drifted" = the raw import
+    // differs from the golden state (see ImportDiff — a signal for what the importer might still
+    // get wrong); "missing" = the verified animal no longer exists in the imported data.
+    public record VerifiedGerbilDto(
+        Guid GerbilId,
+        string? EntityName,
+        bool IsVerified,
+        string Status,
+        DateTimeOffset? VerifiedAt,
+        DateTimeOffset UpdatedAt,
+        string? Note,
+        IReadOnlyList<string> ProtectedFields,
+        IReadOnlyList<SnapshotDiffDto> ImportDiff);
+
+    /// <summary>One field difference between the golden state and the raw import.</summary>
+    public record SnapshotDiffDto(string Path, string? GoldenValue, string? ImportValue);
+
+    /// <summary>Export entry for the committed regression fixture (verified-golden.json).</summary>
+    public record VerifiedGoldenEntry(
+        Guid GerbilId, string? Name, DateTimeOffset? VerifiedAt, Import.GerbilSnapshot? Snapshot);
+
     // Request DTOs -----------------------------------------------------------
 
+    /// <summary>Body for POST /verified-gerbils/{id} — optional free-text note.</summary>
+    public record VerifyGerbilInput(string? Note);
+
     public record GerbilInput(
         string? Name,
         Gender? Gender,
@@ -97,10 +125,12 @@ namespace GerbilManagerWebAPI.Dtos
         DateOnly? Date,
         int? TotalBorn,
         int? DeathsWithin8Weeks,
+        int? Stillborn,
         Guid? FatherId,
         Guid? MotherId,
         DateOnly? ExpectedGoHomeDate,
-        string? Notes);
+        string? Notes,
+        bool? ShowInChronicle = null);
 
     public record ContactInput(string Name, string? Email, string? Phone, string? Address, string? Notes, bool IsBreeder, bool IsReceiver, string? NameSuffix);