feat: expand portfolios, drop wedding crowd photos, offer studio on site

- 28 more of the operator's own public images (42 -> 67), alts from his captions
- remove group-feier, group-outdoor, group-posiert (wedding guests visible)
- studio section now offers Studio Neumuenster and Mobiles Studio
- deploy: --force-recreate on release and rollback, plus in-container content probe
- verify: DESFOTO_BASE dry-run, redirect, asset and privacy checks
- tests: 57 OK (3 new content guards, 2 deploy/verify regression guards)

AGENTS.md

@@ -90,3 +90,10 @@ and removes the obsolete `desfoto.de → dennyschulz.de` labels from `/srv/stack
 `.ocauto/verify <sha>` proves the live site matches the release. Details, including
 rollback, are in `docs/deployment.md`. Traefik is shared infrastructure: route through
 labels, never restart or recreate the proxy.
+
+The deploy replaces `site/` (new inode) and rewrites `nginx.conf`, so it runs
+`docker compose up -d --force-recreate`: a container that is merely "running" keeps
+the deleted directory bind-mounted and then serves an empty document root — every
+path 404, while Compose reports no change and the stale health status still says
+`healthy`. The recreate is followed by an explicit in-container request for `/`, and
+`tests/test_site.py` guards the flag. Never remove either check.