fix(frontend): disable prerender crawl so /, /documents, /persons aren't baked

Closes #514.

The build was prerendering protected routes via crawl from
/hilfe/transkription. Their load functions throw redirect('/login')
during the build (no auth cookie), so SvelteKit captured the redirect
as static HTML and shipped /app/build/prerendered/{index,documents,
persons,geschichten,stammbaum}.html with a `location.href=/login`
script. In production these files are served BEFORE hooks.server.ts
runs, so an authenticated user with a valid cookie is still served
the baked bounce-back page.

Setting `crawl: false` keeps the explicit /hilfe/transkription entry
prerendered (needed for the public help page) without dragging the
nav targets along with it.

Verified locally: build now emits only `hilfe/transkription.html`
under build/prerendered/, no index.html or documents.html etc.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -59,29 +59,6 @@ jobs:
         run: npm run build
         working-directory: frontend
 
-      # ── Prerender output is exactly the public help page ───────────────────
-      # SvelteKit prerender + crawl follows nav links and bakes "redirect to
-      # /login" HTML for every protected route, served BEFORE runtime hooks
-      # (see #514). With `crawl: false` only the explicit entry should land
-      # in build/prerendered/. Anything else is a regression — fail the build.
-      - name: Assert prerender output is only /hilfe/transkription
-        run: |
-          cd frontend
-          set -e
-          extra=$(find build/prerendered -type f \
-                  -not -path 'build/prerendered/hilfe/*' \
-                  -not -name '*.br' -not -name '*.gz' \
-                  || true)
-          if [ -n "$extra" ]; then
-            echo "FAIL: unexpected prerendered files (would shadow runtime hooks):"
-            echo "$extra"
-            exit 1
-          fi
-          # And the help page must still be there.
-          test -f build/prerendered/hilfe/transkription.html \
-            || { echo "FAIL: /hilfe/transkription.html missing from prerender output"; exit 1; }
-          echo "PASS: only /hilfe/transkription.html prerendered."
-
       - name: Upload screenshots
         if: always()
         uses: actions/upload-artifact@v4

docker-compose.prod.yml

@@ -86,10 +86,6 @@ services:
     # runner container's CWD. See #506 + infra/minio/Dockerfile.
     build:
       context: ./infra/minio
-    # Declare one-shot intent so `docker compose up -d --wait` treats
-    # exited(0) as success rather than "not running, fail". Pair with
-    # backend's `service_completed_successfully` dependency below. See #510.
-    restart: "no"
     depends_on:
       minio:
         condition: service_healthy
@@ -164,12 +160,6 @@ services:
         condition: service_healthy
       ocr-service:
         condition: service_healthy
-      # Gate startup on the bucket bootstrap. Without this, backend
-      # starts in parallel with create-buckets and may race the policy
-      # bind. Also tells compose's `up -d --wait` that create-buckets
-      # is a one-shot that must complete successfully. See #510.
-      create-buckets:
-        condition: service_completed_successfully
     # Bound to localhost only — Caddy fronts external traffic.
     ports:
       - "127.0.0.1:${PORT_BACKEND}:8080"