cms: headless CMS vor Hugo (Supabase + Node-API + React-Admin)

All-in-One docker-compose-Stack (Muster von RAPPORT-SERVER gespiegelt):
db/auth/rest/kong + cms-Service (Node-API + Hugo-Binary 0.161.1 + Admin-SPA).

- DB-backed: posts-Tabelle kanonisch, MD ist generiertes Artefakt
- echte Hugo-Vorschau via draft:true + --buildDrafts → /_preview
- Publish: DB → content/library/<section>/<slug>.md → hugo build → live
- Bild-Upload nach static/images/, Supabase-Auth schützt /api/*
- Proxmox-LXC-Script: legt Container an, generiert Secrets, startet Stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cms/api/Dockerfile

@@ -0,0 +1,41 @@
+# --- Stage 1: Admin-SPA bauen ---
+# (Build-Context ist cms/, siehe docker-compose.yml)
+FROM node:24-bookworm-slim AS admin
+WORKDIR /admin
+COPY admin/package.json admin/package-lock.json* ./
+RUN npm install --no-audit --no-fund
+COPY admin/ ./
+# Öffentliche Browser-Werte, zur Build-Zeit eingesetzt.
+ARG VITE_SUPABASE_URL
+ARG VITE_SUPABASE_ANON_KEY
+ENV VITE_SUPABASE_URL=$VITE_SUPABASE_URL
+ENV VITE_SUPABASE_ANON_KEY=$VITE_SUPABASE_ANON_KEY
+RUN npm run build
+
+# --- Stage 2: API + Hugo + serviert Site/Admin ---
+# Debian-slim statt Alpine: Hugo "extended" ist glibc-gelinkt.
+FROM node:24-bookworm-slim
+ARG HUGO_VERSION=0.161.1
+ARG TARGETARCH=amd64
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates git curl \
+ && rm -rf /var/lib/apt/lists/* \
+ && case "${TARGETARCH}" in \
+      arm64) HUGO_ARCH=linux-arm64 ;; \
+      *)     HUGO_ARCH=linux-amd64 ;; \
+    esac \
+ && curl -sSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_${HUGO_ARCH}.tar.gz" \
+      | tar -xz -C /usr/local/bin hugo \
+ && hugo version
+
+WORKDIR /app
+COPY api/package.json api/package-lock.json* ./
+RUN npm install --omit=dev --no-audit --no-fund
+COPY api/src ./src
+COPY --from=admin /admin/dist ./admin-dist
+
+ENV NODE_ENV=production
+ENV ADMIN_DIR=/app/admin-dist
+EXPOSE 3000
+CMD ["node", "src/index.js"]