Migrate omsorgapp to browser SPA, add Docker/CI build setup

- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh
  token moves to an HttpOnly cookie (omsorgCore), CORS added for the new
  browser origin, document download/preview switched to Blob-based browser
  APIs.
- Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml
  wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow
  that builds and pushes images to the repo's container registry on push to
  main and on version tags.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgapp/src/api/usersApi.js

@@ -0,0 +1,39 @@
+import { UsersApi } from "omsorgcore-client-ts";
+import { configFor, callApi } from "./apiClientHelpers.js";
+
+// Kapselt /api/users von omsorgCore (UsersController) über den generierten Client
+// (omsorgcore-client-ts).
+export async function listUsers(accessToken) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersGetRaw());
+}
+
+export async function createUser(accessToken, payload) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersPostRaw({ createUserRequest: payload }));
+}
+
+export async function listPermissionOverrides(accessToken, userId) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersIdPermissionOverridesGetRaw({ id: userId }));
+}
+
+export async function addPermissionOverride(accessToken, userId, payload) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersIdPermissionOverridesPostRaw({ id: userId, addUserPermissionOverrideRequest: payload }));
+}
+
+export async function deletePermissionOverride(accessToken, userId, overrideId) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersIdPermissionOverridesOverrideIdDeleteRaw({ id: userId, overrideId }));
+}
+
+export async function updateUser(accessToken, userId, payload) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersIdPutRaw({ id: userId, updateUserRequest: payload }));
+}
+
+export async function resetPassword(accessToken, userId, payload) {
+  const api = new UsersApi(configFor(accessToken));
+  return callApi(api.apiUsersIdResetPasswordPostRaw({ id: userId, resetUserPasswordRequest: payload }));
+}