cms: add openbureau-core CMS (DB-less, auth: local) — vendored at cms/core

kgva can now be edited through openbureau-core instead of Decap: a small Node CMS
(git subtree at cms/core) with a schema-driven editor at /admin, file-based login
(no Supabase/Postgres), Markdown on disk. cms/kgva.config.js models the content
(portfolio/pages/sections); docker-compose builds the core image (Hugo 0.163.3,
no VITE_SUPABASE_URL → local-auth admin) and mounts the repo as the site. seed an
admin via cms/seed-admin.mjs; deploy/provision-lxc.sh + ADMIN.md updated.

Verified DB-less end-to-end on real content (staged): local login → schema-driven
editor → 42 entries (de/en) → stats → create/preview/cleanup; unknown frontmatter
(image galleries) preserved on save. The LIVE static site (CT130 timer→hugo→nginx)
is unaffected — hugo ignores cms/; the CMS is dormant until provisioned.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -1,8 +1,30 @@
+# kgva website + CMS, powered by openbureau-core (vendored at cms/core).
+# DB-LESS: local file auth (no Supabase/Postgres). The core engine builds the Hugo
+# site and serves it + /admin + /api + /_preview, writing content/ on edits.
+#
+# Provision: cp cms/.env.example cms/.env (set JWT_SECRET), then
+#   docker compose build
+#   docker compose run --rm cms node /site/cms/seed-admin.mjs you@mail pass   # once
+#   docker compose up -d
 services:
-  web:
-    build: .
-    image: kgva
+  cms:
+    build:
+      context: ./cms/core
+      dockerfile: api/Dockerfile
+      args:
+        HUGO_VERSION: "0.163.3"   # kgva needs >= 0.163.3
+        # No VITE_SUPABASE_URL → the admin uses the local-auth login (DB-less).
+    image: kgva-cms
     container_name: kgva
-    ports:
-      - "8080:80"
     restart: unless-stopped
+    environment:
+      CMS_CONFIG: /site/cms/kgva.config.js
+      SITE_DIR: /site
+      USERS_FILE: /site/cms/users.json
+      PORT: "3000"
+    env_file:
+      - cms/.env
+    volumes:
+      - .:/site
+    ports:
+      - "8080:3000"