OPS-1: TrueNAS compose, backup sidecar, Gitea CI draft, ops docs

deploy/truenas/compose.yaml:
  - 4 services: db (postgres:17), api (.NET), frontend (nginx), backup sidecar
  - Named volumes as NAS bind-mounts (paths configured in .env)
  - Healthchecks: db pg_isready, api /health, frontend waits on api
  - ANTHROPIC_API_KEY placeholder for FEAT-12a AI stub

deploy/truenas/.env.example: POSTGRES_PASSWORD, PORT, REGISTRY, dataset paths

deploy/truenas/scripts/:
  - entrypoint.sh: installs daily 03:00 cron, starts crond in foreground
  - backup.sh: pg_dump -> .sql + tar czf photos -> .tar.gz + rotation
  - restore.sh: psql < dump + tar xzf photos; confirmation prompt (-f to skip)
  Predecessor logic (commit 6a37f9e) translated from PowerShell to POSIX sh
  for Alpine containers. Same pg_dump/restore semantics, same KEEP_DAYS rotation.

.gitea/workflows/ci.yml (DRAFT -- inactive until Julian confirms Actions):
  dotnet test + npm test/build on push/PR to main;
  docker build+push to Gitea registry on main push only

docs/ops.md:
  German ops guide -- architecture diagram, first-install checklist,
  start/stop/update commands, backup runbook (manual + auto), ZFS-snapshot
  layering strategy, CI activation steps, open questions, troubleshooting table

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

deploy/truenas/.env.example

@@ -0,0 +1,23 @@
+# GerbilManager Produktionskonfiguration
+# Kopiere diese Datei nach .env und setze die Werte vor dem ersten Start.
+
+# Sicheres Datenbankpasswort (mind. 20 Zeichen, keine Anführungszeichen)
+POSTGRES_PASSWORD=aendere_mich_bitte
+
+# Externer Port fuer das Frontend (Standard: 80)
+PORT=80
+
+# Gitea Container Registry (Standard: truenas:13000/gulum)
+REGISTRY=truenas:13000/gulum
+TAG=latest
+
+# NAS-Dataset-Pfade (TrueNAS SCALE: /mnt/<Pool>/<Dataset>)
+PGDATA_PATH=/mnt/SSD/gerbil/pgdata
+PHOTOS_PATH=/mnt/SSD/gerbil/photos
+BACKUPS_PATH=/mnt/SSD/gerbil/backups
+
+# Backup-Rotation: Anzahl Tage (Standard: 7)
+BACKUP_KEEP_DAYS=7
+
+# Claude-API-Key fuer KI-Verkaufstext (FEAT-12a; leer lassen wenn nicht vorhanden)
+ANTHROPIC_API_KEY=