- 28 more of the operator's own public images (42 -> 67), alts from his captions
- remove group-feier, group-outdoor, group-posiert (wedding guests visible)
- studio section now offers Studio Neumuenster and Mobiles Studio
- deploy: --force-recreate on release and rollback, plus in-container content probe
- verify: DESFOTO_BASE dry-run, redirect, asset and privacy checks
- tests: 57 OK (3 new content guards, 2 deploy/verify regression guards)
The running Traefik instance has no global entrypoint http->https
redirection even though /srv/stack/docker-compose.yml declares one, so
plain http://desfoto.de/ answered with Traefik's default 404 once the old
desfoto-redirect-http router was removed. Route desfoto.de through its own
http router (desfoto-http + desfoto-http-to-https, permanent redirect) via
the proven live Docker provider instead of restarting the shared proxy.
Document the live-config drift in docs/deployment.md.
The live directory /home/denny/stacks/desfoto belongs to denny, but the SSH
deploy identity cannot traverse /home/denny (0750). Run the directory change
and the compose command together under the owning identity via
'sudo -n -u denny bash -c' instead of a bare 'cd' as the SSH user. Applies to
the deploy, the stack teardown and both rollback paths.
