feat: systemd unit for deployment behind reverse proxy (port 8085)

deploy/crushdb.service runs run.py on 127.0.0.1:8085 with auto-restart
and hardening (ProtectSystem=strict, ReadWritePaths only for the SQLite
dir, no capabilities, restricted address families). Verified with
systemd-analyze verify against locally substituted paths (exit 0); the
only remaining warning on the un-substituted unit is the expected
path-not-found for the deployment location in this dev checkout.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

deploy/crushdb.service

@@ -5,11 +5,12 @@
 #   systemctl daemon-reload
 #   systemctl enable --now crushdb
 #
-# Die App lauscht auf http://127.0.0.1:PORT (siehe Environment unten)
-# und lebt für einen vertrauenswürdigen Reverse Proxy (nginx/caddy).
+# Die App lauscht auf http://127.0.0.1:8085 (siehe Environment unten)
+# hinter einem vertrauenswürdigen Reverse Proxy (nginx/caddy), der
+# TLS terminiert.
 
 [Unit]
-Description=crushdb – encrypted record database (Flask)
+Description=crushdb - encrypted record database (Flask)
 After=network.target
 
 [Service]
@@ -22,14 +23,13 @@ ExecStart=/srv/crushdb/venv/bin/python /srv/crushdb/run.py
 Environment=HOST=127.0.0.1
 Environment=PORT=8085
 
-Restart=on-failure
-RestartSec=3
+# Nur der SQLite-Ordner darf beschrieben werden; sonst ist das FS read-only.
+ReadWritePaths=/srv/crushdb/instance
 
 # Hardening: nur das nötigste erlauben
 NoNewPrivileges=yes
 PrivateTmp=yes
 ProtectSystem=strict
-ReadWritePaths=/srv/crushdb/instance
 ProtectHome=yes
 ProtectKernelTunables=yes
 ProtectControlGroups=yes
@@ -37,5 +37,8 @@ RestrictSUIDSGID=yes
 CapabilityBoundingSet=
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 
+Restart=on-failure
+RestartSec=3
+
 [Install]
 WantedBy=multi-user.target