Add release/dev build scripts and branch-based deploy workflow

- scripts/release.sh: build from main, tag :latest + short SHA, push
  both. Aborts if not on main or working tree is dirty; warns on
  unpushed commits. Prevents dev states from becoming :latest.
- scripts/dev-build.sh: local dev image (tagged per branch), never
  pushed -- keeps development builds off the registry.
- docs/deployment.md: document branch/PR workflow, replace manual
  build/push steps with the scripts, SHA-based rollback now standard.
- .gitattributes: force LF on *.sh so the shebang works on Windows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/dev-build.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Baut ein lokales Dev-Image zum Ausprobieren auf dem eigenen Rechner.
+# Pusht NICHTS in die Registry -- der Stand bleibt privat auf dem Laptop.
+#
+# Der Tag enthaelt den aktuellen Branchnamen, damit Dev-Images nicht mit dem
+# Produktiv-:latest verwechselt werden. Anschliessend z.B. lokal starten:
+#   docker run --rm -p 5000:8080 elternbeirat-web:dev-<branch>
+# oder ueber die lokale compose.yaml.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+branch="$(git rev-parse --abbrev-ref HEAD | tr '/' '-')"
+tag="elternbeirat-web:dev-$branch"
+
+echo "Baue lokales Dev-Image: $tag  (kein Push)"
+docker build -t "$tag" .
+
+echo
+echo "Fertig. Lokal starten z.B. mit:"
+echo "  docker run --rm -p 5000:8080 $tag"