Make omsorgapp's backend URL runtime-configurable, use dedicated API subdomain

- omsorgapp now reads the omsorgCore URL from a runtime env-config.js
  generated by the container entrypoint from OMSORG_CORE_URL, instead of
  only baking it in at image build time - docker-compose.yml pulls
  pre-built images from the registry, so a build-time-only value couldn't
  be changed without a rebuild.
- docker-compose.yml: omsorgCore gets its own subdomain
  (core.omsorg-pflegedienste.de) rather than being proxied under the
  frontend's domain - omsorgWeb never needs browser-side access to it
  anyway (server-side cURL only), and a dedicated API host is more
  future-proof without being any less secure (backend still only bound to
  127.0.0.1). Includes the nginx server-block snippet needed for the new
  subdomain.
- Drop the now-unused OMSORG_CORE_PUBLIC_URL build-arg wiring from the
  Gitea Actions workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgapp/src/api/config.js

@@ -1,4 +1,8 @@
 // Einzige Stelle im Projekt, die die Adresse von omsorgCore kennt.
-// Default passt zum lokalen `dotnet run --project src/OmsorgCore.Api` (http-Profil, Port 5245),
-// überschreibbar per Vite-Env-Variable (VITE_OMSORG_CORE_URL) für andere Umgebungen.
-export const API_BASE = import.meta.env.VITE_OMSORG_CORE_URL || "http://localhost:5245";
+// Reihenfolge: 1) Laufzeit-Konfiguration (window.__OMSORG_ENV__, aus env-config.js - vom
+// nginx-Entrypoint im Container aus der OMSORG_CORE_URL-Env-Var generiert, siehe
+// omsorgapp/docker-entrypoint.sh) - so lässt sich die Backend-Adresse rein über
+// docker-compose.yml setzen, ohne das Image neu zu bauen. 2) Vite-Build-Zeit-Env
+// (VITE_OMSORG_CORE_URL, für `npm run dev`/lokale Builds ohne Container). 3) localhost-Default.
+export const API_BASE =
+  window.__OMSORG_ENV__?.OMSORG_CORE_URL || import.meta.env.VITE_OMSORG_CORE_URL || "http://localhost:5245";