feat: expand portfolios, drop wedding crowd photos, offer studio on site

- 28 more of the operator's own public images (42 -> 67), alts from his captions
- remove group-feier, group-outdoor, group-posiert (wedding guests visible)
- studio section now offers Studio Neumuenster and Mobiles Studio
- deploy: --force-recreate on release and rollback, plus in-container content probe
- verify: DESFOTO_BASE dry-run, redirect, asset and privacy checks
- tests: 57 OK (3 new content guards, 2 deploy/verify regression guards)

.ocauto/deploy

@@ -39,7 +39,10 @@ if [ "$release_sha" = "rollback" ]; then
       sudo cp '$target/nginx.conf' '$live_dir/nginx.conf'
       sudo cp '$target/compose.yml' '$live_dir/compose.yml'
       sudo cp '$target/compose.vps.yml' '$live_dir/compose.vps.yml'
-      sudo -n -u denny bash -c \"cd '$live_dir' && docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans\"
+      # --force-recreate for the same reason as in the forward path: the site
+      # tree inode changes, so a merely running container would keep the deleted
+      # directory mounted and serve an empty root.
+      sudo -n -u denny bash -c \"cd '$live_dir' && docker compose -f compose.yml -f compose.vps.yml up -d --force-recreate --remove-orphans\"
     else
       echo '[deploy] initial-state snapshot: removing the desfoto stack again'
       if sudo test -d '$live_dir'; then
@@ -98,12 +101,19 @@ sudo chown -R denny:denny "$LIVE_DIR"
 sudo rm -f "$archive"
 printf '%s\n' "$REMOTE_SHA" | sudo tee "$LIVE_DIR/RELEASE" >/dev/null
 
-# 3. Start or update the stack. The live directory belongs to denny and the SSH
-#    login cannot traverse /home/denny, so the directory change and the compose
-#    command run together in one shell under the owning identity.
-sudo -n -u denny bash -c "cd '$LIVE_DIR' && docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans"
+# 3. Start or update the stack. --force-recreate is deliberate: step 2 replaces
+#    the site directory (new inode) and rewrites nginx.conf, and a container that
+#    is merely "running" keeps the bind mount to the deleted directory and then
+#    serves an empty document root (every request 404) while Compose reports no
+#    change. Recreating costs a moment of 502s behind Traefik and guarantees that
+#    a fresh container binds the new tree and reads the new config. The live
+#    directory belongs to denny and the SSH login cannot traverse /home/denny, so
+#    the directory change and the compose command run together in one shell under
+#    the owning identity.
+sudo -n -u denny bash -c "cd '$LIVE_DIR' && docker compose -f compose.yml -f compose.vps.yml up -d --force-recreate --remove-orphans"
 
-# 4. Wait for the container health check.
+# 4. Wait for the container health check. The healthcheck requests "/" from
+#    inside the container, so an empty document root cannot report healthy.
 for _ in $(seq 1 30); do
   status="$(sudo docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' desfoto-web-1 2>/dev/null || echo missing)"
   [ "$status" = "healthy" ] && break
@@ -117,6 +127,15 @@ if [ "$status" != "healthy" ]; then
   exit 1
 fi
 
+# 4b. Content check, not process check: a stale bind mount served 404 for every
+#     path while Compose still reported the container healthy. Ask the container
+#     itself for the homepage and fail the deploy if it is not served.
+if ! sudo docker exec desfoto-web-1 wget -q --spider http://127.0.0.1/; then
+  echo "[deploy] ERROR: desfoto-web-1 does not serve the release at / (empty mount?)" >&2
+  sudo docker logs --tail 40 desfoto-web-1 >&2 || true
+  exit 1
+fi
+
 # 5. Remove the obsolete desfoto.de redirect from the shared stack project.
 #    The new stack already owns desfoto.de through a higher Traefik priority,
 #    this only deletes the now-dead labels so Traefik no longer advertises them.