feat(deploy): TrueNAS Custom-App + Auto-Deploy, plus aufgelaufene Arbeit

Deployment:
- custom-app.compose.yaml: self-contained Compose fuer TrueNAS "Custom App"
  (absolute Host-Bind-Pfade, postgres:18, pull_policy always, Port 8090)
- scripts/truenas-deploy.sh: Host-Skript create/redeploy via midclt (App
  bleibt unter Apps sichtbar) inkl. Image-Pull + Health-Check
- ci.yml Deploy-Job: laeuft auf ubuntu-latest-Runner, kopiert Deploy-Dateien
  per SSH auf den NAS-Host und triggert truenas-deploy.sh (statt runs-on goldeye)
- compose.yaml/.env.example: postgres:18 (Locale-Match zur Quell-DB), Port 8090
- .gitignore: .agents/, tools/rag/, deploy/truenas/.env (Secrets/Scratch)

Aufgelaufene Feature-Arbeit (verified/Freeze, Migrationen, Import-Triage):
- GerbilOverride/VerifiedGerbil-Endpoints + GerbilSnapshotService + Tests
- EF-Migrationen (ShowInChronicle, Stillborn, BirthOrder, ManualFlag, DSGVO)
- Frontend VerifizierteTierePage + verified-API + e2e-Spec
- diverse Import-/Triage-Skripte und -Tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

GerbilManagerWebAPI/Models/Contact.cs

@@ -30,5 +30,10 @@ namespace GerbilManagerWebAPI.Models
         /// notes). Written by the Python merge_and_resolve step and surfaced read-only
         /// ("Datenherkunft"). Null = manually-added contact / no import data.</summary>
         public string? Provenance { get; set; }
+
+        /// <summary>true = manually created in the UI; false = produced by an import path. The ingest
+        /// re-import wipe deletes ONLY IsManual=false contacts, so a manually-added contact (e.g. the
+        /// Herkunft/Abnehmer of a manual animal) is never wiped. All import paths leave this false.</summary>
+        public bool IsManual { get; set; }
     }
 }