feat(deploy): TrueNAS Custom-App + Auto-Deploy, plus aufgelaufene Arbeit

Deployment:
- custom-app.compose.yaml: self-contained Compose fuer TrueNAS "Custom App"
  (absolute Host-Bind-Pfade, postgres:18, pull_policy always, Port 8090)
- scripts/truenas-deploy.sh: Host-Skript create/redeploy via midclt (App
  bleibt unter Apps sichtbar) inkl. Image-Pull + Health-Check
- ci.yml Deploy-Job: laeuft auf ubuntu-latest-Runner, kopiert Deploy-Dateien
  per SSH auf den NAS-Host und triggert truenas-deploy.sh (statt runs-on goldeye)
- compose.yaml/.env.example: postgres:18 (Locale-Match zur Quell-DB), Port 8090
- .gitignore: .agents/, tools/rag/, deploy/truenas/.env (Secrets/Scratch)

Aufgelaufene Feature-Arbeit (verified/Freeze, Migrationen, Import-Triage):
- GerbilOverride/VerifiedGerbil-Endpoints + GerbilSnapshotService + Tests
- EF-Migrationen (ShowInChronicle, Stillborn, BirthOrder, ManualFlag, DSGVO)
- Frontend VerifizierteTierePage + verified-API + e2e-Spec
- diverse Import-/Triage-Skripte und -Tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/truenas/compose.yaml

@@ -11,8 +11,9 @@
 services:
 
   # --- PostgreSQL-Datenbank ---
+  # postgres:18 (Debian): Locale en_US.utf8 == Quell-DB (Aspire) -> sauberer Dump-Restore.
   db:
-    image: postgres:17-alpine
+    image: postgres:18
     restart: unless-stopped
     environment:
       POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
@@ -58,7 +59,7 @@ services:
       db:
         condition: service_healthy
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/health || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -72,7 +73,8 @@ services:
       dockerfile: gerbil-manager-web/Dockerfile
     restart: unless-stopped
     ports:
-      - "${PORT:-80}:80"
+      # NAS-Port 80 ist durch den nginx-Reverse-Proxy belegt -> Default 8090.
+      - "${PORT:-8090}:80"
     depends_on:
       api:
         condition: service_healthy
@@ -94,7 +96,7 @@ services:
 
   # --- Backup-Sidecar (taeglicher pg_dump + Foto-Archiv + Rotation) ---
   backup:
-    image: postgres:17-alpine
+    image: postgres:18
     restart: unless-stopped
     environment:
       PGPASSWORD: "${POSTGRES_PASSWORD}"