feat(deploy): TrueNAS Custom-App + Auto-Deploy, plus aufgelaufene Arbeit

Deployment:
- custom-app.compose.yaml: self-contained Compose fuer TrueNAS "Custom App"
  (absolute Host-Bind-Pfade, postgres:18, pull_policy always, Port 8090)
- scripts/truenas-deploy.sh: Host-Skript create/redeploy via midclt (App
  bleibt unter Apps sichtbar) inkl. Image-Pull + Health-Check
- ci.yml Deploy-Job: laeuft auf ubuntu-latest-Runner, kopiert Deploy-Dateien
  per SSH auf den NAS-Host und triggert truenas-deploy.sh (statt runs-on goldeye)
- compose.yaml/.env.example: postgres:18 (Locale-Match zur Quell-DB), Port 8090
- .gitignore: .agents/, tools/rag/, deploy/truenas/.env (Secrets/Scratch)

Aufgelaufene Feature-Arbeit (verified/Freeze, Migrationen, Import-Triage):
- GerbilOverride/VerifiedGerbil-Endpoints + GerbilSnapshotService + Tests
- EF-Migrationen (ShowInChronicle, Stillborn, BirthOrder, ManualFlag, DSGVO)
- Frontend VerifizierteTierePage + verified-API + e2e-Spec
- diverse Import-/Triage-Skripte und -Tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

GerbilManagerWebAPI/Endpoints/ContactEndpoints.cs

@@ -24,7 +24,7 @@ namespace GerbilManagerWebAPI.Endpoints
 
             group.MapPost("/", async (ContactInput input, ApplicationContext db) =>
             {
-                var c = new Contact { Id = Guid.NewGuid(), Name = input.Name, Email = input.Email, Phone = input.Phone, Address = input.Address, Notes = input.Notes, IsBreeder = input.IsBreeder, IsReceiver = input.IsReceiver, NameSuffix = input.NameSuffix };
+                var c = new Contact { Id = Guid.NewGuid(), Name = input.Name, Email = input.Email, Phone = input.Phone, Address = input.Address, Notes = input.Notes, IsBreeder = input.IsBreeder, IsReceiver = input.IsReceiver, NameSuffix = input.NameSuffix, IsManual = true };
                 db.Contacts.Add(c);
                 await db.SaveChangesAsync();
                 return TypedResults.Created($"/contacts/{c.Id}", ToDto(c));

GerbilManagerWebAPI/Endpoints/GerbilEndpoints.cs

@@ -1,5 +1,6 @@
 using GerbilManagerWebAPI.Common;
 using GerbilManagerWebAPI.Dtos;
+using GerbilManagerWebAPI.Import;
 using GerbilManagerWebAPI.Models;
 using GerbilManagerWebAPI.Services;
 using Gridify;
@@ -61,7 +62,9 @@ namespace GerbilManagerWebAPI.Endpoints
                 if (string.IsNullOrWhiteSpace(input.Name))
                     return TypedResults.ValidationProblem(new Dictionary<string, string[]> { ["name"] = ["Name is required."] });
 
-                var g = new Gerbil { Id = Guid.NewGuid(), Name = input.Name! };
+                // Manually created in the UI → IsManual=true, so the import re-ingest never wipes or
+                // overwrites this animal (and its sub-records).
+                var g = new Gerbil { Id = Guid.NewGuid(), Name = input.Name!, IsManual = true };
                 Apply(g, input, isCreate: true);
                 db.Gerbils.Add(g);
                 await db.SaveChangesAsync();
@@ -73,8 +76,17 @@ namespace GerbilManagerWebAPI.Endpoints
             {
                 var g = await db.Gerbils.FirstOrDefaultAsync(x => x.Id == id);
                 if (g is null) return TypedResults.NotFound();
+
+                // Capture the own-field values BEFORE the edit so manual changes to an IMPORTED animal
+                // can be pinned per-field (survive the next ingest). Manual animals need no override —
+                // they survive the ingest wholesale.
+                var before = GerbilSnapshotService.BuildFreezeObject(g);
                 Apply(g, input, isCreate: false);
                 await db.SaveChangesAsync();
+
+                if (!g.IsManual)
+                    await RecordEditOverrideAsync(db, g, before);
+
                 return TypedResults.NoContent();
             });
 
@@ -133,11 +145,47 @@ namespace GerbilManagerWebAPI.Endpoints
             GerbilStatusService.Apply(g, DateOnly.FromDateTime(DateTime.UtcNow));
         }
 
+        // EDIT PROTECTION: after a manual edit to an IMPORTED animal, pin the change so the next
+        // ingest can't overwrite it. A VERIFIED animal keeps its certification and its whole golden
+        // is refreshed to the edited state (Frage 5). An unverified animal gets/updates a "geschützt"
+        // override carrying ONLY the changed fields (per-field) — untouched fields keep receiving
+        // import improvements. Called after the edit is already persisted.
+        private static async Task RecordEditOverrideAsync(ApplicationContext db, Gerbil g, System.Text.Json.Nodes.JsonObject before)
+        {
+            var ov = await db.GerbilOverrides.FirstOrDefaultAsync(o => o.GerbilId == g.Id);
+            if (ov is { IsVerified: true })
+            {
+                ov.EntityName = g.Name;
+                ov.OverrideJson = GerbilSnapshotService.BuildFreezeJson(g);
+                var snap = await GerbilSnapshotService.BuildSnapshotAsync(db, g.Id);
+                if (snap is not null) ov.SnapshotJson = GerbilSnapshotService.SerializeSnapshot(snap);
+                ov.LastImportSnapshotJson = null;
+                ov.LastImportDiffJson = null;
+                ov.UpdatedAt = DateTimeOffset.UtcNow;
+                await db.SaveChangesAsync();
+                return;
+            }
+
+            var after = GerbilSnapshotService.BuildFreezeObject(g);
+            var changed = GerbilSnapshotService.ChangedFields(before, after);
+            if (changed.Count == 0) return;
+
+            if (ov is null)
+            {
+                ov = new GerbilOverride { Id = Guid.NewGuid(), GerbilId = g.Id, IsVerified = false, OverrideJson = "{}" };
+                db.GerbilOverrides.Add(ov);
+            }
+            ov.EntityName = g.Name;
+            ov.OverrideJson = GerbilSnapshotService.MergeOverrideJson(ov.OverrideJson, changed);
+            ov.UpdatedAt = DateTimeOffset.UtcNow;
+            await db.SaveChangesAsync();
+        }
+
         internal static GerbilDto ToDto(Gerbil g, string? profilePhotoUrl = null) => new(
             g.Id, g.Name, g.Gender, g.Status, g.LitterId, g.OriginContactId, g.ReceiverContactId,
             g.EnclosureId, g.ColorVarietyId, g.DateOfBirth, g.DateOfDeath, g.CauseOfDeath,
             g.GoHomeDate, g.Genotype, g.SpottingType, g.Notes, g.ImportSource, g.ExternalRef, g.OriginBreeder,
             g.CharacterTraits, g.CharacterNote, g.IsDeaf, g.IsResident, profilePhotoUrl, g.IsCastrated,
-            g.Provenance);
+            g.Provenance, g.BirthOrder);
     }
 }

GerbilManagerWebAPI/Endpoints/LitterEndpoints.cs

@@ -30,7 +30,7 @@ namespace GerbilManagerWebAPI.Endpoints
                 var mortalityErr = ValidateMortality(input.DeathsWithin8Weeks, input.TotalBorn);
                 if (mortalityErr is not null) return TypedResults.BadRequest(mortalityErr);
 
-                var l = new Litter { Id = Guid.NewGuid(), Name = input.Name, Date = input.Date };
+                var l = new Litter { Id = Guid.NewGuid(), Name = input.Name, Date = input.Date, IsManual = true };
                 Apply(l, input);
                 db.Litters.Add(l);
                 await db.SaveChangesAsync();
@@ -81,10 +81,15 @@ namespace GerbilManagerWebAPI.Endpoints
         {
             l.TotalBorn = i.TotalBorn;
             l.DeathsWithin8Weeks = i.DeathsWithin8Weeks;
+            l.Stillborn = i.Stillborn;
             l.FatherId = i.FatherId;
             l.MotherId = i.MotherId;
             l.ExpectedGoHomeDate = i.ExpectedGoHomeDate;
             l.Notes = i.Notes;
+            // Nur überschreiben, wenn explizit gesetzt — sonst bestehenden Wert / Modell-Default
+            // (true) behalten, damit ein Edit ohne dieses Feld einen versteckten Wurf nicht
+            // versehentlich wieder in die Wurfchronik holt.
+            if (i.ShowInChronicle is bool show) l.ShowInChronicle = show;
         }
 
         private static string? ValidateMortality(int? deaths, int? totalBorn)
@@ -97,8 +102,8 @@ namespace GerbilManagerWebAPI.Endpoints
         }
 
         private static LitterDto ToDto(Litter l) => new(
-            l.Id, l.Name, l.Date, l.TotalBorn, l.DeathsWithin8Weeks,
-            l.FatherId, l.MotherId, l.ExpectedGoHomeDate, l.Notes, l.Provenance);
+            l.Id, l.Name, l.Date, l.TotalBorn, l.DeathsWithin8Weeks, l.Stillborn,
+            l.FatherId, l.MotherId, l.ExpectedGoHomeDate, l.Notes, l.Provenance, l.ShowInChronicle);
     }
 
     /// <summary>400 body for a father×mother gender mismatch; frontend localises by Code.</summary>

GerbilManagerWebAPI/Endpoints/VerifiedGerbilEndpoints.cs

@@ -0,0 +1,136 @@
+using System.Text.Json;
+using GerbilManagerWebAPI.Dtos;
+using GerbilManagerWebAPI.Import;
+using GerbilManagerWebAPI.Models;
+using Microsoft.AspNetCore.Http.HttpResults;
+using Microsoft.EntityFrameworkCore;
+
+namespace GerbilManagerWebAPI.Endpoints
+{
+    /// <summary>
+    /// VERIFIED / PROTECTED OVERRIDES — the breeder's hand-curated "this animal is correct" layer.
+    ///   POST   /verified-gerbils/{gerbilId} -> mark "vollständig korrekt": snapshot the full Akte,
+    ///          freeze all own fields, apply the freeze immediately. Toggle-on. Optional {note}.
+    ///   DELETE /verified-gerbils/{gerbilId} -> remove the override (un-flag / release protection).
+    ///          Non-destructive: current values stay; the next ingest makes the animal import-driven again.
+    ///   GET    /verified-gerbils            -> all overrides (verified + protected) with drift status.
+    ///   GET    /verified-gerbils/{gerbilId} -> single status (badge on the Rennmausakte).
+    ///   GET    /verified-gerbils/export     -> canonical golden dump for the committed regression fixture.
+    /// Overrides are decoupled from gerbils (loose GerbilId, no FK), so they survive the import
+    /// re-ingest wipe and are re-applied on top of the fresh import (the "freeze").
+    /// </summary>
+    public static class VerifiedGerbilEndpoints
+    {
+        private static readonly JsonSerializerOptions Json = new(JsonSerializerDefaults.Web);
+
+        public static IEndpointRouteBuilder MapVerifiedGerbilEndpoints(this IEndpointRouteBuilder app)
+        {
+            var group = app.MapGroup("/verified-gerbils").WithTags("VerifiedGerbils");
+
+            group.MapPost("/{gerbilId:guid}", async Task<Results<Ok<VerifiedGerbilDto>, NotFound>> (
+                Guid gerbilId, VerifyGerbilInput? input, ApplicationContext db) =>
+            {
+                var g = await db.Gerbils.FirstOrDefaultAsync(x => x.Id == gerbilId);
+                if (g is null) return TypedResults.NotFound();
+
+                var snapshot = await GerbilSnapshotService.BuildSnapshotAsync(db, gerbilId);
+
+                var ov = await db.GerbilOverrides.FirstOrDefaultAsync(o => o.GerbilId == gerbilId);
+                if (ov is null)
+                {
+                    ov = new GerbilOverride { Id = Guid.NewGuid(), GerbilId = gerbilId, OverrideJson = "{}" };
+                    db.GerbilOverrides.Add(ov);
+                }
+                ov.EntityName = g.Name;
+                ov.IsVerified = true;
+                ov.OverrideJson = GerbilSnapshotService.BuildFreezeJson(g);
+                ov.SnapshotJson = snapshot is null ? null : GerbilSnapshotService.SerializeSnapshot(snapshot);
+                // Reset the drift cache — recomputed on the next ingest against the fresh import.
+                ov.LastImportSnapshotJson = null;
+                ov.LastImportDiffJson = null;
+                ov.Note = string.IsNullOrWhiteSpace(input?.Note) ? ov.Note : input!.Note!.Trim();
+                ov.VerifiedAt ??= DateTimeOffset.UtcNow;
+                ov.UpdatedAt = DateTimeOffset.UtcNow;
+                await db.SaveChangesAsync();
+                return TypedResults.Ok(await ToDtoAsync(db, ov));
+            });
+
+            group.MapDelete("/{gerbilId:guid}", async Task<Results<NoContent, NotFound>> (
+                Guid gerbilId, ApplicationContext db) =>
+            {
+                var ov = await db.GerbilOverrides.FirstOrDefaultAsync(o => o.GerbilId == gerbilId);
+                if (ov is null) return TypedResults.NotFound();
+                db.GerbilOverrides.Remove(ov);
+                await db.SaveChangesAsync();
+                return TypedResults.NoContent();
+            });
+
+            group.MapGet("/", async (ApplicationContext db) =>
+            {
+                var rows = await db.GerbilOverrides.ToListAsync();
+                var existingIds = await db.Gerbils.Select(g => g.Id).ToHashSetAsync();
+                var list = new List<VerifiedGerbilDto>();
+                foreach (var ov in rows.OrderByDescending(o => o.UpdatedAt))
+                    list.Add(await ToDtoAsync(db, ov, existingIds));
+                return TypedResults.Ok(list);
+            });
+
+            group.MapGet("/export", async (ApplicationContext db) =>
+            {
+                var rows = await db.GerbilOverrides.Where(o => o.IsVerified).ToListAsync();
+                var export = rows
+                    .OrderBy(o => o.EntityName, StringComparer.Ordinal)
+                    .ThenBy(o => o.GerbilId)
+                    .Select(o => new VerifiedGoldenEntry(
+                        o.GerbilId, o.EntityName, o.VerifiedAt,
+                        GerbilSnapshotService.DeserializeSnapshot(o.SnapshotJson)))
+                    .ToList();
+                return TypedResults.Ok(export);
+            });
+
+            group.MapGet("/{gerbilId:guid}", async Task<Results<Ok<VerifiedGerbilDto>, NotFound>> (
+                Guid gerbilId, ApplicationContext db) =>
+            {
+                var ov = await db.GerbilOverrides.FirstOrDefaultAsync(o => o.GerbilId == gerbilId);
+                if (ov is null) return TypedResults.NotFound();
+                return TypedResults.Ok(await ToDtoAsync(db, ov));
+            });
+
+            return app;
+        }
+
+        private static async Task<VerifiedGerbilDto> ToDtoAsync(
+            ApplicationContext db, GerbilOverride ov, HashSet<Guid>? existingIds = null)
+        {
+            var exists = existingIds?.Contains(ov.GerbilId) ?? await db.Gerbils.AnyAsync(g => g.Id == ov.GerbilId);
+            var diffs = DeserializeDiff(ov.LastImportDiffJson);
+            var status = !exists ? "missing" : (diffs.Count > 0 ? "drifted" : "unchanged");
+            return new VerifiedGerbilDto(
+                ov.GerbilId, ov.EntityName, ov.IsVerified, status, ov.VerifiedAt, ov.UpdatedAt, ov.Note,
+                ExtractFieldKeys(ov.OverrideJson), diffs);
+        }
+
+        private static IReadOnlyList<SnapshotDiffDto> DeserializeDiff(string? json)
+        {
+            if (string.IsNullOrWhiteSpace(json)) return Array.Empty<SnapshotDiffDto>();
+            try
+            {
+                var raw = JsonSerializer.Deserialize<List<SnapshotDiff>>(json, Json) ?? new();
+                return raw.Select(d => new SnapshotDiffDto(d.Path, d.GoldenValue, d.OtherValue)).ToList();
+            }
+            catch (JsonException) { return Array.Empty<SnapshotDiffDto>(); }
+        }
+
+        private static IReadOnlyList<string> ExtractFieldKeys(string? overrideJson)
+        {
+            if (string.IsNullOrWhiteSpace(overrideJson)) return Array.Empty<string>();
+            try
+            {
+                using var doc = JsonDocument.Parse(overrideJson);
+                if (doc.RootElement.ValueKind != JsonValueKind.Object) return Array.Empty<string>();
+                return doc.RootElement.EnumerateObject().Select(p => p.Name).ToList();
+            }
+            catch (JsonException) { return Array.Empty<string>(); }
+        }
+    }
+}