DevOps: Coolify-Testserver-Deployment (Compose, Migrations-Job, Runbook)

- docker-compose.coolify.yml: Coolify-taugliche Variante (kein host-port,
  Env via Coolify-Variablen, migrate-Init-Job vor app, app-Healthcheck)
- .env.coolify.example: Referenz der Coolify-Env-Variablen (nur Platzhalter)
- docs/DEPLOY-COOLIFY.md: Runbook (Gitea-Deploy-Key, Ressource, Env, Domain, Seed)
- .gitignore: .env.coolify.example whitelisten

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.coolify.example

@@ -0,0 +1,39 @@
+# Referenz für die Coolify-Environment-Variablen (Testserver, intern).
+# ECHTE Secrets NUR in Coolify eintragen — diese Datei enthält nur Platzhalter.
+# In Coolify: Ressource -> Environment Variables (Bulk-Paste möglich).
+# Hostnamen sind die Compose-Service-Namen (postgres/redis/minio), NICHT localhost.
+
+# --- Datenbank (Service "postgres") ---
+POSTGRES_USER=isms
+POSTGRES_PASSWORD=CHANGE_ME_db_password
+POSTGRES_DB=isms
+DATABASE_URL=postgresql://isms:CHANGE_ME_db_password@postgres:5432/isms?schema=public
+
+# --- Redis (Service "redis") ---
+REDIS_URL=redis://redis:6379
+
+# --- Objektspeicher (Service "minio") ---
+# S3_ACCESS_KEY == MINIO_ROOT_USER und S3_SECRET_KEY == MINIO_ROOT_PASSWORD!
+S3_ENDPOINT=http://minio:9000
+S3_ACCESS_KEY=isms
+S3_SECRET_KEY=CHANGE_ME_minio_password
+S3_BUCKET=isms-documents
+MINIO_ROOT_USER=isms
+MINIO_ROOT_PASSWORD=CHANGE_ME_minio_password
+
+# --- Auth (NextAuth) ---
+# AUTH_SECRET: openssl rand -base64 32
+# AUTH_URL: exakt die Coolify-Domain des app-Service (http:// für intern)
+AUTH_SECRET=CHANGE_ME_openssl_rand_base64_32
+AUTH_URL=http://REPLACE-WITH-COOLIFY-SSLIP-DOMAIN
+
+# --- KI-Provider (optional, aktuell ungenutzt) ---
+AI_PROVIDER=anthropic
+AI_API_KEY=
+
+# --- E-Mail (optional, im Test ungenutzt) ---
+SMTP_HOST=
+SMTP_PORT=1025
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=isms@example.com