OPS-1: TrueNAS compose, backup sidecar, Gitea CI draft, ops docs

deploy/truenas/compose.yaml:
  - 4 services: db (postgres:17), api (.NET), frontend (nginx), backup sidecar
  - Named volumes as NAS bind-mounts (paths configured in .env)
  - Healthchecks: db pg_isready, api /health, frontend waits on api
  - ANTHROPIC_API_KEY placeholder for FEAT-12a AI stub

deploy/truenas/.env.example: POSTGRES_PASSWORD, PORT, REGISTRY, dataset paths

deploy/truenas/scripts/:
  - entrypoint.sh: installs daily 03:00 cron, starts crond in foreground
  - backup.sh: pg_dump -> .sql + tar czf photos -> .tar.gz + rotation
  - restore.sh: psql < dump + tar xzf photos; confirmation prompt (-f to skip)
  Predecessor logic (commit 6a37f9e) translated from PowerShell to POSIX sh
  for Alpine containers. Same pg_dump/restore semantics, same KEEP_DAYS rotation.

.gitea/workflows/ci.yml (DRAFT -- inactive until Julian confirms Actions):
  dotnet test + npm test/build on push/PR to main;
  docker build+push to Gitea registry on main push only

docs/ops.md:
  German ops guide -- architecture diagram, first-install checklist,
  start/stop/update commands, backup runbook (manual + auto), ZFS-snapshot
  layering strategy, CI activation steps, open questions, troubleshooting table

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

deploy/truenas/compose.yaml

@@ -0,0 +1,109 @@
+# GerbilManager — TrueNAS Custom Application
+# ==============================================
+# Vor dem ersten Start:
+#   1. Kopiere deploy/truenas/.env.example -> deploy/truenas/.env und setze die Werte.
+#   2. Lege die Dataset-Pfade auf der NAS an (pgdata, photos, backups).
+#   3. docker compose -f deploy/truenas/compose.yaml up -d
+#
+# Zugriff: http://<NAS-IP>:${PORT:-80}
+# API-Doku: http://<NAS-IP>:${PORT:-80}/scalar
+
+services:
+
+  # --- PostgreSQL-Datenbank ---
+  db:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
+      POSTGRES_DB: gerbilmanager
+      POSTGRES_USER: postgres
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d gerbilmanager"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+  # --- .NET API (GerbilManagerWebAPI) ---
+  api:
+    image: "${REGISTRY:-truenas:13000/gulum}/gerbilmanager-api:${TAG:-latest}"
+    build:
+      context: ../..
+      dockerfile: GerbilManagerWebAPI/Dockerfile
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_ENVIRONMENT: Production
+      # Verbindung zur Postgres-DB im selben Compose-Netz
+      ConnectionStrings__gerbilmanager: "Host=db;Port=5432;Database=gerbilmanager;Username=postgres;Password=${POSTGRES_PASSWORD}"
+      # Speicherort der hochgeladenen Fotos (NAS-Dataset gemounted unter /data/photos)
+      Photos__RootPath: /data/photos
+      # KI-Verkaufstext (FEAT-12a stub; leer lassen wenn kein Key vorhanden)
+      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
+    volumes:
+      - photos:/data/photos
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 90s
+
+  # --- nginx Frontend (React SPA + API-Proxy) ---
+  frontend:
+    image: "${REGISTRY:-truenas:13000/gulum}/gerbilmanager-frontend:${TAG:-latest}"
+    build:
+      context: ../..
+      dockerfile: gerbil-manager-web/Dockerfile
+    restart: unless-stopped
+    ports:
+      - "${PORT:-80}:80"
+    depends_on:
+      api:
+        condition: service_healthy
+
+  # --- Backup-Sidecar (taeglicher pg_dump + Foto-Archiv + Rotation) ---
+  backup:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      PGPASSWORD: "${POSTGRES_PASSWORD}"
+      POSTGRES_HOST: db
+      POSTGRES_USER: postgres
+      POSTGRES_DB: gerbilmanager
+      BACKUP_KEEP_DAYS: "${BACKUP_KEEP_DAYS:-7}"
+    volumes:
+      - photos:/data/photos:ro
+      - backups:/backups
+      - ./scripts:/scripts:ro
+    depends_on:
+      db:
+        condition: service_healthy
+    entrypoint: ["/bin/sh", "/scripts/entrypoint.sh"]
+
+volumes:
+  # NAS-Datasets als Bind-Mounts (Pfade in .env konfigurieren).
+  # TrueNAS: Dataset-Pfad z.B. /mnt/SSD/gerbil/pgdata
+  pgdata:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "${PGDATA_PATH:-/mnt/gerbil/pgdata}"
+  photos:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "${PHOTOS_PATH:-/mnt/gerbil/photos}"
+  backups:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "${BACKUPS_PATH:-/mnt/gerbil/backups}"