feat(deploy): TrueNAS Custom-App + Auto-Deploy, plus aufgelaufene Arbeit

Deployment:
- custom-app.compose.yaml: self-contained Compose fuer TrueNAS "Custom App"
  (absolute Host-Bind-Pfade, postgres:18, pull_policy always, Port 8090)
- scripts/truenas-deploy.sh: Host-Skript create/redeploy via midclt (App
  bleibt unter Apps sichtbar) inkl. Image-Pull + Health-Check
- ci.yml Deploy-Job: laeuft auf ubuntu-latest-Runner, kopiert Deploy-Dateien
  per SSH auf den NAS-Host und triggert truenas-deploy.sh (statt runs-on goldeye)
- compose.yaml/.env.example: postgres:18 (Locale-Match zur Quell-DB), Port 8090
- .gitignore: .agents/, tools/rag/, deploy/truenas/.env (Secrets/Scratch)

Aufgelaufene Feature-Arbeit (verified/Freeze, Migrationen, Import-Triage):
- GerbilOverride/VerifiedGerbil-Endpoints + GerbilSnapshotService + Tests
- EF-Migrationen (ShowInChronicle, Stillborn, BirthOrder, ManualFlag, DSGVO)
- Frontend VerifizierteTierePage + verified-API + e2e-Spec
- diverse Import-/Triage-Skripte und -Tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/truenas/custom-app.compose.yaml

@@ -0,0 +1,97 @@
+# GerbilManager — TrueNAS SCALE Custom App (Goldeye 25.10)
+# =========================================================
+# Diese Datei ist die VORLAGE fuer die TrueNAS-"Custom App" (taucht unter Apps auf).
+# Sie wird NICHT direkt mit `docker compose` gestartet, sondern von
+#   deploy/truenas/scripts/truenas-deploy.sh
+# gerendert (Platzhalter aus deploy/truenas/.env eingesetzt) und via
+#   midclt call app.create {custom_app:true, app_name:gerbilmanager, custom_compose_config_string:<yaml>}
+# an die TrueNAS-Middleware uebergeben. Redeploys laufen ueber `midclt call app.redeploy`.
+#
+# Unterschiede zur lokalen deploy/truenas/compose.yaml:
+#   * ABSOLUTE Host-Bind-Pfade (Custom Apps kennen keine relativen ./-Mounts) —
+#     gleiche Konvention wie die anderen Apps dieser NAS (/mnt/JailStorage/DockerVolumes/...).
+#   * pull_policy: always  -> `app.redeploy` zieht das frische :latest aus der Registry.
+#   * kein publicsite-Container (oeffentliche Seite ist ein separater Schritt mit Domain/Proxy).
+#
+# Platzhalter (werden von truenas-deploy.sh aus .env ersetzt):
+#   __POSTGRES_PASSWORD__  __REGISTRY__  __TAG__  __PORT__  __AI_BASEURL__  __AI_APIKEY__  __AI_MODEL__
+
+services:
+
+  # --- PostgreSQL 18 (Debian-Image: Locale en_US.utf8 == Quell-DB) ---
+  db:
+    image: postgres:18
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: "__POSTGRES_PASSWORD__"
+      POSTGRES_DB: gerbilmanager
+      POSTGRES_USER: postgres
+      TZ: Europe/Berlin
+    volumes:
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d gerbilmanager"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+  # --- .NET API ---
+  api:
+    image: "__REGISTRY__/gerbilmanager-api:__TAG__"
+    pull_policy: always
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_ENVIRONMENT: Production
+      ConnectionStrings__gerbilmanager: "Host=db;Port=5432;Database=gerbilmanager;Username=postgres;Password=__POSTGRES_PASSWORD__"
+      Photos__RootPath: /data/photos
+      DataProtection__KeyRingPath: /data/keys
+      PublicSite__RootPath: /data/publicsite
+      AI__BaseUrl: "__AI_BASEURL__"
+      AI__ApiKey: "__AI_APIKEY__"
+      AI__Model: "__AI_MODEL__"
+      TZ: Europe/Berlin
+    volumes:
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/photos:/data/photos
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/keys:/data/keys
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/publicsite:/data/publicsite
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 90s
+
+  # --- Frontend (nginx: React-SPA + /api-Proxy) ---
+  frontend:
+    image: "__REGISTRY__/gerbilmanager-frontend:__TAG__"
+    pull_policy: always
+    restart: unless-stopped
+    ports:
+      - "__PORT__:80"
+    depends_on:
+      api:
+        condition: service_healthy
+
+  # --- Backup-Sidecar (taeglicher pg_dump + Foto-Archiv + Rotation) ---
+  backup:
+    image: postgres:18
+    restart: unless-stopped
+    environment:
+      PGPASSWORD: "__POSTGRES_PASSWORD__"
+      POSTGRES_HOST: db
+      POSTGRES_USER: postgres
+      POSTGRES_DB: gerbilmanager
+      BACKUP_KEEP_DAYS: "7"
+      TZ: Europe/Berlin
+    volumes:
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/photos:/data/photos:ro
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/backups:/backups
+      - /mnt/JailStorage/DockerVolumes/gerbilmanager/scripts:/scripts:ro
+    depends_on:
+      db:
+        condition: service_healthy
+    entrypoint: ["/bin/sh", "/scripts/entrypoint.sh"]