OPS-1: TrueNAS compose, backup sidecar, Gitea CI draft, ops docs

deploy/truenas/compose.yaml:
  - 4 services: db (postgres:17), api (.NET), frontend (nginx), backup sidecar
  - Named volumes as NAS bind-mounts (paths configured in .env)
  - Healthchecks: db pg_isready, api /health, frontend waits on api
  - ANTHROPIC_API_KEY placeholder for FEAT-12a AI stub

deploy/truenas/.env.example: POSTGRES_PASSWORD, PORT, REGISTRY, dataset paths

deploy/truenas/scripts/:
  - entrypoint.sh: installs daily 03:00 cron, starts crond in foreground
  - backup.sh: pg_dump -> .sql + tar czf photos -> .tar.gz + rotation
  - restore.sh: psql < dump + tar xzf photos; confirmation prompt (-f to skip)
  Predecessor logic (commit 6a37f9e) translated from PowerShell to POSIX sh
  for Alpine containers. Same pg_dump/restore semantics, same KEEP_DAYS rotation.

.gitea/workflows/ci.yml (DRAFT -- inactive until Julian confirms Actions):
  dotnet test + npm test/build on push/PR to main;
  docker build+push to Gitea registry on main push only

docs/ops.md:
  German ops guide -- architecture diagram, first-install checklist,
  start/stop/update commands, backup runbook (manual + auto), ZFS-snapshot
  layering strategy, CI activation steps, open questions, troubleshooting table

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,115 @@
+# GerbilManager CI — Gitea Actions
+# =================================
+# STATUS: ENTWURF — inaktiv bis Julian Gitea Actions aktiviert.
+# Aktivierung: Gitea -> Repository -> Einstellungen -> Actions -> "Actions aktivieren"
+# Anschliessend: Gitea Actions Runner auf der NAS installieren (siehe docs/ops.md).
+#
+# Was dieser Workflow tut:
+#   1. dotnet test (alle xUnit-Projekte)
+#   2. npm test + npm run build (Frontend)
+#   3. Docker-Images bauen und in die Gitea-Registry pushen
+#
+# Registry: truenas:13000  (internes Gitea Container Registry)
+# Images:
+#   truenas:13000/gulum/gerbilmanager-api:latest
+#   truenas:13000/gulum/gerbilmanager-frontend:latest
+
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+env:
+  REGISTRY: truenas:13000
+  REGISTRY_OWNER: gulum
+  DOTNET_VERSION: "10.0.x"
+  NODE_VERSION: "22"
+
+jobs:
+  test-backend:
+    name: Backend Tests (.NET)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: .NET SDK einrichten
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Pakete wiederherstellen
+        run: dotnet restore GerbilManager.slnx
+
+      - name: Build
+        run: dotnet build GerbilManager.slnx --no-restore -c Release
+
+      - name: Tests ausfuehren
+        run: dotnet test GerbilManager.slnx --no-build -c Release --logger "console;verbosity=normal"
+
+  test-frontend:
+    name: Frontend Tests (Node/Vite)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Node.js einrichten
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "npm"
+          cache-dependency-path: gerbil-manager-web/package-lock.json
+
+      - name: Abhaengigkeiten installieren
+        run: npm ci
+        working-directory: gerbil-manager-web
+
+      - name: Tests ausfuehren
+        run: npm test
+        working-directory: gerbil-manager-web
+
+      - name: Produktionsbuild pruefen
+        run: npm run build
+        working-directory: gerbil-manager-web
+
+  build-and-push:
+    name: Docker Build & Push
+    runs-on: ubuntu-latest
+    needs: [test-backend, test-frontend]
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Bei Gitea Registry anmelden
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Docker Buildx einrichten
+        uses: docker/setup-buildx-action@v3
+
+      - name: API-Image bauen und pushen
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: GerbilManagerWebAPI/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.REGISTRY_OWNER }}/gerbilmanager-api:latest
+            ${{ env.REGISTRY }}/${{ env.REGISTRY_OWNER }}/gerbilmanager-api:${{ github.sha }}
+
+      - name: Frontend-Image bauen und pushen
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: gerbil-manager-web/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.REGISTRY_OWNER }}/gerbilmanager-frontend:latest
+            ${{ env.REGISTRY }}/${{ env.REGISTRY_OWNER }}/gerbilmanager-frontend:${{ github.sha }}