fix(ci): Fix Hetzner deploy — host filesystem access + network + dependencies

Problems fixed:
1. Deploy step couldn't access /opt/breakpilot-compliance (host path not
   mounted in runner container). Now uses alpine/git helper container with
   host bind-mount for git ops, then docker compose with host paths.
2. breakpilot-network was external:true but Core doesn't run on Hetzner.
   Override in hetzner.yml creates the network automatically.
3. core-health-check blocks startup waiting for Core. Override in
   hetzner.yml makes it exit immediately.
4. RAG ingestion script now respects RAG_URL/QDRANT_URL env vars.
5. RAG workflow discovers network dynamically from running containers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -190,54 +190,76 @@ jobs:
           COMPOSE_FILES="-f docker-compose.yml -f docker-compose.hetzner.yml"
           COMMIT_SHA="${GITHUB_SHA:-unknown}"
           SHORT_SHA="${COMMIT_SHA:0:8}"
+          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
 
           echo "=== BreakPilot Compliance Deploy ==="
           echo "Commit: ${SHORT_SHA}"
           echo "Deploy Dir: ${DEPLOY_DIR}"
           echo ""
 
-          # 1. Repo auf dem Host aktualisieren
-          if [ ! -d "${DEPLOY_DIR}/.git" ]; then
-            echo "FEHLER: ${DEPLOY_DIR} ist kein Git-Repository"
-            echo "Bitte einmalig einrichten:"
-            echo "  git clone <repo-url> ${DEPLOY_DIR}"
-            echo "  cp .env.example ${DEPLOY_DIR}/.env  # und anpassen"
-            exit 1
-          fi
+          # Der Runner laeuft in einem Container mit Docker-Socket-Zugriff,
+          # hat aber KEINEN direkten Zugriff auf das Host-Dateisystem.
+          # Loesung: Alpine-Helper-Container mit Host-Bind-Mount fuer Git-Ops.
 
-          # Git pull im Deploy-Verzeichnis
-          apk add --no-cache git > /dev/null 2>&1
-          cd "${DEPLOY_DIR}"
-          git fetch origin main
-          git reset --hard origin/main
+          # 1. Repo auf dem Host erstellen/aktualisieren via Helper-Container
+          echo "=== Updating code on host ==="
+          docker run --rm \
+            -v "${DEPLOY_DIR}:${DEPLOY_DIR}" \
+            alpine/git:latest \
+            sh -c "
+              if [ ! -d '${DEPLOY_DIR}/.git' ]; then
+                echo 'Erstmaliges Klonen nach ${DEPLOY_DIR}...'
+                git clone '${REPO_URL}' '${DEPLOY_DIR}'
+              else
+                cd '${DEPLOY_DIR}'
+                git fetch origin main
+                git reset --hard origin/main
+              fi
+            "
           echo "Code aktualisiert auf ${SHORT_SHA}"
 
-          # 2. Core-Services (admin, backend, ai-sdk, dev-portal) bauen
+          # 2. .env sicherstellen (muss einmalig manuell angelegt werden)
+          docker run --rm -v "${DEPLOY_DIR}:${DEPLOY_DIR}" alpine \
+            sh -c "
+              if [ ! -f '${DEPLOY_DIR}/.env' ]; then
+                echo 'WARNUNG: ${DEPLOY_DIR}/.env fehlt!'
+                echo 'Bitte einmalig auf dem Host anlegen.'
+                echo 'Deploy wird fortgesetzt (Services starten ggf. mit Defaults).'
+              else
+                echo '.env vorhanden'
+              fi
+            "
+
+          # 3. Docker Images bauen (docker compose liest vom Host-Dateisystem)
           echo ""
           echo "=== Building Docker Images ==="
-          docker compose ${COMPOSE_FILES} build \
-            --parallel \
+          docker compose -f "${DEPLOY_DIR}/docker-compose.yml" \
+            -f "${DEPLOY_DIR}/docker-compose.hetzner.yml" \
+            --project-directory "${DEPLOY_DIR}" \
+            build --parallel \
             admin-compliance \
             backend-compliance \
             ai-compliance-sdk \
             developer-portal
 
-          # 3. Container neu starten (nur geaenderte)
+          # 4. Container neu starten
           echo ""
           echo "=== Deploying ==="
-          docker compose ${COMPOSE_FILES} up -d \
-            --remove-orphans \
+          docker compose -f "${DEPLOY_DIR}/docker-compose.yml" \
+            -f "${DEPLOY_DIR}/docker-compose.hetzner.yml" \
+            --project-directory "${DEPLOY_DIR}" \
+            up -d --remove-orphans \
             admin-compliance \
             backend-compliance \
             ai-compliance-sdk \
             developer-portal
 
-          # 4. Health Checks
+          # 5. Health Checks
           echo ""
           echo "=== Health Checks ==="
           sleep 10
 
-          for svc in bp-compliance-admin bp-compliance-backend bp-compliance-ai-sdk; do
+          for svc in bp-compliance-admin bp-compliance-backend bp-compliance-ai-sdk bp-compliance-developer-portal; do
             STATUS=$(docker inspect --format='{{.State.Status}}' "${svc}" 2>/dev/null || echo "not found")
             echo "${svc}: ${STATUS}"
           done