Migrate omsorgapp to browser SPA, add Docker/CI build setup

- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh
  token moves to an HttpOnly cookie (omsorgCore), CORS added for the new
  browser origin, document download/preview switched to Blob-based browser
  APIs.
- Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml
  wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow
  that builds and pushes images to the repo's container registry on push to
  main and on version tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -0,0 +1,55 @@
+name: Docker-Images bauen und veröffentlichen
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+
+env:
+  REGISTRY: git.omsorg-pflegedienste.de
+  IMAGE_NAMESPACE: admin/omsorg
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - image: omsorgcore
+            dockerfile: omsorgCore/Dockerfile
+            build_args: ""
+          - image: omsorgapp
+            dockerfile: omsorgapp/Dockerfile
+            build_args: "VITE_OMSORG_CORE_URL=${{ vars.OMSORG_CORE_PUBLIC_URL }}"
+          - image: omsorgweb
+            dockerfile: omsorgWeb/Dockerfile
+            build_args: ""
+    steps:
+      - name: Code auschecken
+        uses: actions/checkout@v4
+
+      - name: Bei Registry anmelden
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ env.REGISTRY }} -u "${{ gitea.actor }}" --password-stdin
+
+      - name: Image bauen und pushen
+        run: |
+          BUILD_ARGS=""
+          if [ -n "${{ matrix.build_args }}" ]; then
+            BUILD_ARGS="--build-arg ${{ matrix.build_args }}"
+          fi
+
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/${{ matrix.image }}"
+          TAGS="-t $IMAGE:latest -t $IMAGE:${{ gitea.sha }}"
+
+          # Bei einem Tag-Push (z.B. v0.1.0) zusätzlich mit dem Tag-Namen selbst versionieren,
+          # damit ein bestimmter Release pinnbar bleibt statt nur :latest/:<sha>.
+          if [ "${{ gitea.ref_type }}" = "tag" ]; then
+            TAGS="$TAGS -t $IMAGE:${{ gitea.ref_name }}"
+          fi
+
+          docker buildx build \
+            --push \
+            -f "${{ matrix.dockerfile }}" \
+            $TAGS \
+            $BUILD_ARGS \
+            .