feat: add Docker deployment, web installer, and local test environment

- Multi-stage Dockerfiles for API (NestJS) and Web (Next.js standalone)
- docker-compose.prod.yml: full production stack (postgres, redis, keycloak,
  api, web) with optional Caddy/Let's Encrypt via --profile ssl
- docker-compose.local.yml: identical local test stack, all ports exposed
- docker/postgres/init.sql: auto-creates tos_app DB on first start
- Caddyfile: reverse proxy for app domain + auth subdomain
- install.sh: interactive installer (domain, SSL mode, secret generation)
- NestJS SetupModule: @Public() endpoints for /setup/status, /setup/admin,
  /setup/branding, /setup/complete with setup-token guard
- Web installer: 4-step flow (system check, admin creation, branding, complete)
  at /[locale]/setup/* with public middleware bypass
- i18n: installer namespace added to de.json and en.json
- CORS: x-setup-token header allowed in main.ts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,53 @@
+# =============================================================================
+# tOS Docker Build Context Ignore
+# =============================================================================
+# Diese Datei verhindert, dass unnoetige Dateien in den Docker Build Context
+# kopiert werden. Das beschleunigt den Build und reduziert die Image-Groesse.
+# =============================================================================
+
+# Dependencies (werden im Container neu installiert)
+node_modules
+**/node_modules
+
+# Build-Artefakte
+.next
+**/dist
+.turbo
+
+# Versionskontrolle
+.git
+.gitignore
+
+# Logs
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Environment-Dateien (Secrets gehoeren nicht ins Image!)
+.env
+.env.local
+.env.*.local
+.env.development
+.env.production
+
+# Docker-Daten (vermeidet rekursives Kopieren)
+docker/data
+
+# Test & Coverage
+coverage
+.nyc_output
+
+# Temporaere Dateien
+tmp
+temp
+.cache
+
+# IDE-Konfiguration
+.vscode
+.idea
+*.swp
+*.swo
+
+# OS-Dateien
+.DS_Store
+Thumbs.db