Migrate omsorgapp to browser SPA, add Docker/CI build setup

- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh
  token moves to an HttpOnly cookie (omsorgCore), CORS added for the new
  browser origin, document download/preview switched to Blob-based browser
  APIs.
- Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml
  wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow
  that builds and pushes images to the repo's container registry on push to
  main and on version tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgapp/src/api/authApi.js

@@ -0,0 +1,75 @@
+import { AuthApi } from "omsorgcore-client-ts";
+import { configFor, callApi } from "./apiClientHelpers.js";
+
+// Kapselt /api/auth/* von omsorgCore über den generierten Client (omsorgcore-client-ts).
+// refresh/logout brauchen keinen Refresh-Token-Parameter mehr - er steckt in der
+// HttpOnly-Cookie, die der Browser dank credentials:"include" automatisch mitschickt.
+function toTokenPair(data) {
+  return {
+    accessToken: data.accessToken,
+    expiresAt: data.expiresAt,
+    mustChangePassword: !!data.mustChangePassword
+  };
+}
+
+export async function login(username, password) {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthLoginPostRaw({ loginRequest: { username, password } }));
+  if (!result.ok) {
+    return { ok: false, status: result.status, error: result.error || result.data?.error };
+  }
+  return { ok: true, ...toTokenPair(result.data) };
+}
+
+export async function refresh() {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthRefreshPostRaw());
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, ...toTokenPair(result.data) };
+}
+
+export async function logout() {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthLogoutPostRaw());
+  return { ok: result.ok, status: result.status };
+}
+
+export async function me(accessToken) {
+  const api = new AuthApi(configFor(accessToken));
+  const result = await callApi(api.apiAuthMeGetRaw());
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, username: result.data.username, role: result.data.role, permissions: result.data.permissions };
+}
+
+export async function requestPasswordReset(username) {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthForgotPasswordRequestPostRaw({ forgotPasswordRequestRequest: { username } }));
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, status: result.data.status };
+}
+
+export async function verifyPasswordResetCode(username, pin) {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthForgotPasswordVerifyPostRaw({ forgotPasswordVerifyRequest: { username, pin } }));
+  if (!result.ok) return { ok: false, status: result.status, error: result.data?.error };
+  return { ok: true, resetToken: result.data.resetToken };
+}
+
+export async function resetPassword(resetToken, newPassword) {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthForgotPasswordResetPostRaw({ forgotPasswordResetRequest: { resetToken, newPassword } }));
+  return { ok: result.ok, status: result.status, data: result.data };
+}
+
+export async function changePassword(accessToken, currentPassword, newPassword) {
+  const api = new AuthApi(configFor(accessToken));
+  const result = await callApi(api.apiAuthChangePasswordPostRaw({ changePasswordRequest: { currentPassword, newPassword } }));
+  return { ok: result.ok, status: result.status, data: result.data };
+}
+
+export async function getPasswordPolicy() {
+  const api = new AuthApi(configFor(undefined));
+  const result = await callApi(api.apiAuthPasswordPolicyGetRaw());
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, minLength: result.data.minLength };
+}