feat: apt-based deployment via Gitea Debian registry

Deklarix now ships as a .deb package instead of a raw binary, matching
the enconf-webpanel infrastructure standard: scripts/build.sh assembles
a real .deb (systemd unit, env template, postinst/prerm), scripts/release.sh
uploads it to Gitea's built-in Debian package registry after a green
test run. Target servers add one apt source and get updates via
`apt upgrade` from then on.

postinst only starts the service once DATABASE_URL is actually set in
/etc/deklarix/deklarix.env — the shipped template ships it commented out
on purpose, since an uncommented but unfilled placeholder URL is
syntactically indistinguishable from a real one and caused exactly that
crash-loop during verification.

Verified end-to-end against the real test server and Gitea registry:
upload -> apt-get update -> apt-cache policy -> apt-get install -> a
service that stays down until configured, then runs migrations and
serves /health once a real database is set.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/release.sh

@@ -6,13 +6,14 @@
 #
 # Was passiert:
 #   1. Tests laufen
-#   2. Build für amd64 + arm64
-#   3. git tag v<version> wird gesetzt
-#   4. git push origin main + git push origin v<version>
+#   2. .deb-Pakete bauen (amd64 + arm64)
+#   3. Pakete in Giteas Debian-Paketregistrierung hochladen (Kanal "testing")
+#   4. git tag v<version> wird gesetzt
+#   5. git push origin main + git push origin v<version>
 #
 # Voraussetzungen:
 #   - Sauberer Git-Status (keine uncommitted changes)
-#   - Alle Tests grün
+#   - Alle Tests grün (inkl. DATABASE_URL für die Store-Integrationstests)
 
 set -euo pipefail
 
@@ -24,8 +25,9 @@ if [[ -z "$VERSION" ]]; then
     exit 1
 fi
 
-GRN='\033[0;32m'; BLD='\033[1m'; NC='\033[0m'
-log() { echo -e "${GRN}[release]${NC} $*"; }
+GRN='\033[0;32m'; YLW='\033[0;33m'; BLD='\033[1m'; NC='\033[0m'
+log()  { echo -e "${GRN}[release]${NC} $*"; }
+warn() { echo -e "${YLW}[release]${NC} $*"; }
 
 cd "$REPO_DIR"
 
@@ -43,9 +45,46 @@ log "Tests laufen..."
 bash "$REPO_DIR/scripts/test.sh"
 
 # Build
-log "Build für alle Architekturen..."
+log "Pakete bauen..."
 bash "$REPO_DIR/scripts/build.sh" "$VERSION"
 
+# ─── apt-Kanal-Modell ────────────────────────────────────────────────────────
+# Suite = OS-Codename, Komponente = Kanal. Deklarix hat aktuell nur einen
+# Kanal (testing) — es gibt noch keine Kunden, für die "stable" vom
+# aktuellen Entwicklungsstand getrennt werden müsste. Sobald das relevant
+# wird: gleiches Promote-Modell wie enconf-webpanel (release.sh stable).
+GITEA_URL="https://git.netcell-it.de"
+GITEA_ORG="projekte"
+GITEA_CHANNEL="testing"
+APT_SUITES=(bookworm trixie)
+
+GITEA_TOKEN="$(git -C "$REPO_DIR" remote get-url origin | grep -oP '://[^:]+:\K[^@]+' 2>/dev/null || echo '')"
+if [ -z "$GITEA_TOKEN" ]; then
+    echo "FEHLER: Gitea-Token nicht im Git-Remote gefunden."
+    exit 1
+fi
+
+upload_deb() {
+    curl -sk -w "%{http_code}" -o /dev/null -X PUT \
+        "$GITEA_URL/api/packages/$GITEA_ORG/debian/pool/$2/$3/upload" \
+        -H "Authorization: token $GITEA_TOKEN" --upload-file "$1" 2>/dev/null
+}
+
+log "Pakete → Gitea-Debian-Registry (${APT_SUITES[*]} / $GITEA_CHANNEL)..."
+for deb in "$REPO_DIR"/dist/deklarix_"${VERSION}"_*.deb; do
+    [ -f "$deb" ] || { echo "FEHLER: kein .deb für Version $VERSION in dist/ gefunden"; exit 1; }
+    b="$(basename "$deb")"
+    for suite in "${APT_SUITES[@]}"; do
+        code=$(upload_deb "$deb" "$suite" "$GITEA_CHANNEL")
+        if [ "$code" = "201" ] || [ "$code" = "409" ]; then
+            log "  ✅ $b → $suite/$GITEA_CHANNEL"
+        else
+            echo "FEHLER: Upload $b → $suite/$GITEA_CHANNEL fehlgeschlagen (HTTP $code)"
+            exit 1
+        fi
+    done
+done
+
 # Git Tag
 log "Tag v${VERSION} setzen..."
 git tag -a "v${VERSION}" -m "Release v${VERSION}"
@@ -57,4 +96,5 @@ git push origin "v${VERSION}"
 
 log ""
 log "Release v${VERSION} fertig ✓"
-log "Binaries: dist/deklarix_${VERSION}_amd64 + _arm64"
+log "Pakete: dist/deklarix_${VERSION}_amd64.deb + _arm64.deb"
+log "Installation/Update auf Zielservern: apt install/upgrade deklarix"