cms: add openbureau-core CMS (DB-less, auth: local) — vendored at cms/core

kgva can now be edited through openbureau-core instead of Decap: a small Node CMS
(git subtree at cms/core) with a schema-driven editor at /admin, file-based login
(no Supabase/Postgres), Markdown on disk. cms/kgva.config.js models the content
(portfolio/pages/sections); docker-compose builds the core image (Hugo 0.163.3,
no VITE_SUPABASE_URL → local-auth admin) and mounts the repo as the site. seed an
admin via cms/seed-admin.mjs; deploy/provision-lxc.sh + ADMIN.md updated.

Verified DB-less end-to-end on real content (staged): local login → schema-driven
editor → 42 entries (de/en) → stats → create/preview/cleanup; unknown frontmatter
(image galleries) preserved on save. The LIVE static site (CT130 timer→hugo→nginx)
is unaffected — hugo ignores cms/; the CMS is dormant until provisioned.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/provision-lxc.sh

@@ -37,10 +37,24 @@ pct exec "$CTID" -- bash -lc '
     > /etc/apt/sources.list.d/docker.list
   apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
   rm -rf /opt/kgva && git clone '"$REPO"' /opt/kgva
-  cd /opt/kgva && docker compose up -d --build
+  cd /opt/kgva
+  # DB-less CMS env: random token secret (once).
+  [ -f cms/.env ] || sed "s#CHANGE_ME#$(openssl rand -hex 32)#" cms/.env.example > cms/.env
+  # the CMS runs as uid 1000 and must write content/ + build public/.
+  chown -R 1000:1000 /opt/kgva
+  docker compose build
+  # seed an admin on first provision; password saved to cms/ADMIN_PASSWORD.txt.
+  if [ ! -f cms/users.json ]; then
+    PW="$(openssl rand -base64 12)"
+    docker compose run --rm -T cms node /site/cms/seed-admin.mjs karim@gabrielevarano.ch "$PW"
+    printf "%s\n" "$PW" > cms/ADMIN_PASSWORD.txt
+    chown 1000:1000 cms/ADMIN_PASSWORD.txt cms/users.json
+  fi
+  docker compose up -d
 '
 
 echo
-echo "done. test the new container:   curl -I http://${IP%/*}:8080"
+echo "done. CMS admin at http://${IP%/*}:8080/admin/  (login: karim@… / cms/ADMIN_PASSWORD.txt)"
+echo "test:   curl -I http://${IP%/*}:8080"
 echo "then point Caddy at ${IP%/*}:8080 (see deploy/Caddyfile), reload caddy,"
 echo "verify the domain, and only THEN remove the old container."