cms: headless CMS vor Hugo (Supabase + Node-API + React-Admin)

All-in-One docker-compose-Stack (Muster von RAPPORT-SERVER gespiegelt):
db/auth/rest/kong + cms-Service (Node-API + Hugo-Binary 0.161.1 + Admin-SPA).

- DB-backed: posts-Tabelle kanonisch, MD ist generiertes Artefakt
- echte Hugo-Vorschau via draft:true + --buildDrafts → /_preview
- Publish: DB → content/library/<section>/<slug>.md → hugo build → live
- Bild-Upload nach static/images/, Supabase-Auth schützt /api/*
- Proxmox-LXC-Script: legt Container an, generiert Secrets, startet Stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cms/db/schema.sql

@@ -0,0 +1,33 @@
+-- OPENBUREAU CMS — posts-Tabelle. In den Supabase-Stack einspielen
+-- (SQL-Editor oder psql). Spalten bilden das Hugo-Frontmatter ab.
+
+create extension if not exists "pgcrypto";
+
+create table if not exists public.posts (
+  id           uuid primary key default gen_random_uuid(),
+  section      text not null,            -- buerofuehrung | software | theorie
+  slug         text not null,            -- a-z0-9- (Dateiname ohne .md)
+  title        text not null,
+  date         date not null default current_date,
+  weight       int,
+  tags         text[] default '{}',
+  summary      text,
+  cover_image  text,
+  layout       text,                     -- z.B. "image" | "text"
+  external     text,                     -- externer Link (wie RAPPORT)
+  color        text,                     -- z.B. "kusa" | "yuyake"
+  body         text default '',          -- Markdown-Inhalt
+  status       text not null default 'draft',  -- draft | published
+  author       text,
+  created_at   timestamptz not null default now(),
+  updated_at   timestamptz not null default now(),
+  published_at timestamptz,
+  unique (section, slug)
+);
+
+create index if not exists posts_status_idx on public.posts (status);
+create index if not exists posts_section_idx on public.posts (section);
+
+-- RLS aktivieren; die api nutzt den Service-Key (umgeht RLS). Wenn das
+-- Frontend später direkt liest, hier gezielte Policies ergänzen.
+alter table public.posts enable row level security;