Dissolve plan.md into docs/, move open work to Gitea issues

docs/deployment.md

@@ -187,33 +187,12 @@ Requires two repository secrets (Gitea → repo → **Settings** → **Actions**
 - `REGISTRY_TOKEN` — a Gitea access token with **`package: write`**, *not* the
   login password.
 
+The workflow currently only builds and pushes — it does **not** run the tests
+yet, and it does **not** deploy. Those open steps (tests in the workflow,
+auto-deploy with a health gate via Watchtower, encrypting the registry token on
+Unraid) are tracked in `tasks/002-deployment-automatisieren.md`.
+
 Two known pitfalls: the `act_runner` needs Docker socket access to build, and it
 must offer the `ubuntu-latest` label the workflow asks for. To check the runner:
 Gitea → repo (or site admin) → **Settings** → **Actions** → **Runners** — it
 should be listed as **online** with a label set that includes `ubuntu-latest`.
-
-### Auto-deploy via Watchtower (open — needs a health gate first)
-
-Automatically rolling out `:latest` the moment it lands in the registry is
-tempting, but **not** something to switch on blindly: a build can be green and
-still serve a broken page (a bad content file, a runtime-only culture crash like
-the de-DE one). Auto-deploy without a gate would push that live **unnoticed**.
-
-So before turning this on, decide the gate:
-
-- The container must prove itself **healthy** before it replaces the running one
-  — but the chiseled image has no shell, so a `HEALTHCHECK` with `curl`/`sh` does
-  not work inside it. The check has to come from outside (e.g. an external probe
-  hitting a known route, or a compose-level check from a sidecar).
-- Watchtower must be **label-scoped** to *only* the `eb-web` container, otherwise
-  it updates the entire home-lab inventory.
-- Keep a fast **rollback**: pin `:<sha>` in the Unraid compose and bring it back
-  up (see "Rollback" above).
-
-Until that gate exists, deployment stays manual on purpose.
-
-### Encrypt the registry token on Unraid (open)
-
-Currently the token sits in plain text in `/root/.docker/config.json`. Set up a
-credential helper later, so that the plain-text warning from `docker login`
-disappears.