Migrate omsorgapp to browser SPA, add Docker/CI build setup

- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh
  token moves to an HttpOnly cookie (omsorgCore), CORS added for the new
  browser origin, document download/preview switched to Blob-based browser
  APIs.
- Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml
  wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow
  that builds and pushes images to the repo's container registry on push to
  main and on version tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgWeb/mitarbeiter-app/lib/auth.php

@@ -132,6 +132,21 @@ function current_role(): string {
     return $_SESSION['omsorgcore_profile']['role'] ?? '';
 }
 
+// Serverseitig ist jeder Endpunkt ohnehin über [RequirePermission] gegated (siehe
+// omsorgCore/CLAUDE.md, "Rechtesystem") - das hier ist nur die UI-Seite davon (Tab/Formular
+// ausblenden statt nur eine 403-Antwort abzuwarten), analog zu hasPermission() in
+// omsorgapp/src/app/AuthContext.jsx. $_SESSION['omsorgcore_profile']['permissions'] kommt aus
+// GET /api/auth/me (PermissionDto[] { module, action, scope }, siehe MeResponse in omsorgCore).
+function has_permission(string $module, string $action): bool {
+    $permissions = $_SESSION['omsorgcore_profile']['permissions'] ?? [];
+    foreach ($permissions as $permission) {
+        if (($permission['module'] ?? null) === $module && ($permission['action'] ?? null) === $action) {
+            return true;
+        }
+    }
+    return false;
+}
+
 function e(string $s): string {
     return htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
 }