Migrate omsorgapp to browser SPA, add Docker/CI build setup

- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh
  token moves to an HttpOnly cookie (omsorgCore), CORS added for the new
  browser origin, document download/preview switched to Blob-based browser
  APIs.
- Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml
  wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow
  that builds and pushes images to the repo's container registry on push to
  main and on version tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgWeb/mitarbeiter-app/api-client-php/lib/Model/PermissionDto.php

@@ -57,8 +57,9 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
       * @var string[]
       */
     protected static $openAPITypes = [
-        'module' => 'string',
-        'action' => 'string'
+        'module' => '\OmsorgCoreClient\Model\ModuleType',
+        'action' => '\OmsorgCoreClient\Model\PermissionAction',
+        'scope' => '\OmsorgCoreClient\Model\PermissionScope'
     ];
 
     /**
@@ -70,7 +71,8 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
       */
     protected static $openAPIFormats = [
         'module' => null,
-        'action' => null
+        'action' => null,
+        'scope' => null
     ];
 
     /**
@@ -79,8 +81,9 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
       * @var boolean[]
       */
     protected static array $openAPINullables = [
-        'module' => true,
-        'action' => true
+        'module' => false,
+        'action' => false,
+        'scope' => false
     ];
 
     /**
@@ -170,7 +173,8 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
      */
     protected static $attributeMap = [
         'module' => 'module',
-        'action' => 'action'
+        'action' => 'action',
+        'scope' => 'scope'
     ];
 
     /**
@@ -180,7 +184,8 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
      */
     protected static $setters = [
         'module' => 'setModule',
-        'action' => 'setAction'
+        'action' => 'setAction',
+        'scope' => 'setScope'
     ];
 
     /**
@@ -190,7 +195,8 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
      */
     protected static $getters = [
         'module' => 'getModule',
-        'action' => 'getAction'
+        'action' => 'getAction',
+        'scope' => 'getScope'
     ];
 
     /**
@@ -252,6 +258,7 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
     {
         $this->setIfExists('module', $data ?? [], null);
         $this->setIfExists('action', $data ?? [], null);
+        $this->setIfExists('scope', $data ?? [], null);
     }
 
     /**
@@ -299,7 +306,7 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
     /**
      * Gets module
      *
-     * @return string|null
+     * @return \OmsorgCoreClient\Model\ModuleType|null
      */
     public function getModule()
     {
@@ -309,21 +316,14 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
     /**
      * Sets module
      *
-     * @param string|null $module module
+     * @param \OmsorgCoreClient\Model\ModuleType|null $module module
      *
      * @return self
      */
     public function setModule($module)
     {
         if (is_null($module)) {
-            array_push($this->openAPINullablesSetToNull, 'module');
-        } else {
-            $nullablesSetToNull = $this->getOpenAPINullablesSetToNull();
-            $index = array_search('module', $nullablesSetToNull);
-            if ($index !== FALSE) {
-                unset($nullablesSetToNull[$index]);
-                $this->setOpenAPINullablesSetToNull($nullablesSetToNull);
-            }
+            throw new \InvalidArgumentException('non-nullable module cannot be null');
         }
         $this->container['module'] = $module;
 
@@ -333,7 +333,7 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
     /**
      * Gets action
      *
-     * @return string|null
+     * @return \OmsorgCoreClient\Model\PermissionAction|null
      */
     public function getAction()
     {
@@ -343,26 +343,46 @@ class PermissionDto implements ModelInterface, ArrayAccess, \JsonSerializable
     /**
      * Sets action
      *
-     * @param string|null $action action
+     * @param \OmsorgCoreClient\Model\PermissionAction|null $action action
      *
      * @return self
      */
     public function setAction($action)
     {
         if (is_null($action)) {
-            array_push($this->openAPINullablesSetToNull, 'action');
-        } else {
-            $nullablesSetToNull = $this->getOpenAPINullablesSetToNull();
-            $index = array_search('action', $nullablesSetToNull);
-            if ($index !== FALSE) {
-                unset($nullablesSetToNull[$index]);
-                $this->setOpenAPINullablesSetToNull($nullablesSetToNull);
-            }
+            throw new \InvalidArgumentException('non-nullable action cannot be null');
         }
         $this->container['action'] = $action;
 
         return $this;
     }
+
+    /**
+     * Gets scope
+     *
+     * @return \OmsorgCoreClient\Model\PermissionScope|null
+     */
+    public function getScope()
+    {
+        return $this->container['scope'];
+    }
+
+    /**
+     * Sets scope
+     *
+     * @param \OmsorgCoreClient\Model\PermissionScope|null $scope scope
+     *
+     * @return self
+     */
+    public function setScope($scope)
+    {
+        if (is_null($scope)) {
+            throw new \InvalidArgumentException('non-nullable scope cannot be null');
+        }
+        $this->container['scope'] = $scope;
+
+        return $this;
+    }
     /**
      * Returns true if offset exists. False otherwise.
      *