refactor: replace custom CRM with Monica fork

MISCHLABS_DEPLOYMENT.md

@@ -0,0 +1,83 @@
+# MischLabs Monica Deployment
+
+This repository is the MischLabs fork of Monica CRM, based on the upstream `monicahq/monica` `4.x` branch.
+
+## Repository and Image
+
+- Gitea repository: `https://git.mischlabs.de/MrDiderot/CRM.git`
+- Upstream base: `https://github.com/monicahq/monica`, branch `4.x`
+- Registry image: `git.mischlabs.de/mrdiderot/crm:latest`
+- NAS path: `/volume2/docker/mischcrm`
+- Default NAS port: `38090:80`
+
+## Architecture
+
+The NAS does not build the image locally. Gitea Actions builds the Monica image from `scripts/docker/Dockerfile` and pushes it to the local Gitea registry. The NAS runs:
+
+- `mischcrm`: Monica Apache web container
+- `mischcrm_cron`: Monica scheduler container using `cron.sh`
+- `mischcrm_db`: MariaDB 11
+
+Persistent Docker volumes:
+
+- `mischcrm_monica_storage`: Monica storage, OAuth keys, uploads, logs
+- `mischcrm_monica_db`: MariaDB data
+
+## First Start on NAS
+
+```bash
+cd /volume2/docker/mischcrm
+cp .env.mischlabs.example .env
+```
+
+Generate secrets:
+
+```bash
+openssl rand -base64 32
+openssl rand -hex 32
+```
+
+Edit `.env`:
+
+- `APP_KEY` must be `base64:<openssl rand -base64 32 output>`
+- `DB_PASSWORD` must be the long random hex password
+- `APP_URL` must match the public reverse proxy URL, for example `https://crm.mischlabs.de`
+
+Then start:
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+Check:
+
+```bash
+docker ps --filter "name=mischcrm" --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"
+docker logs mischcrm --tail=120
+```
+
+## Updates
+
+Watchtower should update `git.mischlabs.de/mrdiderot/crm:latest` automatically after Gitea Actions pushes a new image.
+
+Manual update:
+
+```bash
+cd /volume2/docker/mischcrm
+git pull --ff-only
+docker compose pull
+docker compose up -d
+```
+
+## Important
+
+Do not commit `.env`.
+
+Do not delete the Docker volumes unless you explicitly want to remove Monica data.
+
+If Monica redirects incorrectly behind Cloudflare/Nginx Proxy Manager, check:
+
+- `APP_URL`
+- `APP_TRUSTED_PROXIES=*`
+- reverse proxy target port `38090`