feat: systemd unit for deployment behind reverse proxy

Adds deploy/crushdb.service: plain HTTP on 127.0.0.1:5000 (HOST/PORT
env), auto-restart on failure, hardened with ProtectSystem/strict,
NoNewPrivileges, capability drop and restricted address families so
only the SQLite dir and private tmp are writable. Passes
systemd-analyze verify (the one reported warning is the expected
/path-in-this-repo venv path of the source checkout, not the deployed
one).

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

deploy/crushdb.service

@@ -0,0 +1,41 @@
+# crushdb systemd unit
+#
+# Installieren (als root):
+#   cp deploy/crushdb.service /etc/systemd/system/
+#   systemctl daemon-reload
+#   systemctl enable --now crushdb
+#
+# Die App lauscht auf http://127.0.0.1:PORT (siehe Environment unten)
+# und lebt für einen vertrauenswürdigen Reverse Proxy (nginx/caddy).
+
+[Unit]
+Description=crushdb – encrypted record database (Flask)
+After=network.target
+
+[Service]
+Type=simple
+# Pfade anpassen, wo dieses Repo liegt:
+User=jonas
+Group=jonas
+WorkingDirectory=/srv/crushdb
+ExecStart=/srv/crushdb/venv/bin/python /srv/crushdb/run.py
+Environment=HOST=127.0.0.1
+Environment=PORT=5000
+
+Restart=on-failure
+RestartSec=3
+
+# Hardening: nur das nötigste erlauben
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ReadWritePaths=/srv/crushdb/instance
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+CapabilityBoundingSet=
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+[Install]
+WantedBy=multi-user.target