fix(ci): Fix Hetzner deploy — host filesystem access + network + dependencies

Problems fixed:
1. Deploy step couldn't access /opt/breakpilot-compliance (host path not
   mounted in runner container). Now uses alpine/git helper container with
   host bind-mount for git ops, then docker compose with host paths.
2. breakpilot-network was external:true but Core doesn't run on Hetzner.
   Override in hetzner.yml creates the network automatically.
3. core-health-check blocks startup waiting for Core. Override in
   hetzner.yml makes it exit immediately.
4. RAG ingestion script now respects RAG_URL/QDRANT_URL env vars.
5. RAG workflow discovers network dynamically from running containers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/rag-ingest.yaml

@@ -6,6 +6,7 @@
 # Phasen: gesetze, eu, templates, datenschutz, verbraucherschutz, verify, version, all
 #
 # Voraussetzung: RAG-Service und Qdrant muessen auf Hetzner laufen.
+# Die BreakPilot-Services muessen deployed sein (ci.yaml deploy-hetzner).
 
 name: RAG Ingestion
 
@@ -24,37 +25,68 @@ jobs:
     steps:
       - name: Setup
         run: |
-          apk add --no-cache git curl bash python3 > /dev/null 2>&1
+          apk add --no-cache git curl bash > /dev/null 2>&1
 
       - name: Checkout
         run: |
           git clone --depth 1 --branch main ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
 
-      - name: Discover RAG Service
+      - name: Run Ingestion
         run: |
           set -euo pipefail
-          echo "=== Docker Environment Discovery ==="
+          PHASE="${{ github.event.inputs.phase }}"
+          DEPLOY_DIR="/opt/breakpilot-compliance"
+
+          echo "=== RAG Ingestion: Phase ${PHASE} ==="
           echo ""
 
-          echo "--- Alle Container ---"
-          docker ps --format "table {{.Names}}\t{{.Ports}}\t{{.Networks}}" 2>/dev/null || true
+          # Pruefen ob Services laufen
+          echo "--- BreakPilot Container ---"
+          docker ps --filter name=bp- --format "{{.Names}}: {{.Status}}" 2>/dev/null || true
           echo ""
 
-          echo "--- Container mit Port 8097 ---"
-          docker ps --format "{{.Names}} {{.Ports}}" 2>/dev/null | grep -i "8097" || echo "Kein Container auf Port 8097"
+          # Netzwerk finden in dem die bp-Services laufen
+          BP_NETWORK=$(docker inspect bp-core-rag-service --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}' 2>/dev/null || echo "")
+          if [ -z "$BP_NETWORK" ]; then
+            # Fallback: Netzwerk vom Compliance-Backend nehmen
+            BP_NETWORK=$(docker inspect bp-compliance-backend --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}' 2>/dev/null || echo "")
+          fi
+
+          if [ -z "$BP_NETWORK" ]; then
+            echo "FEHLER: Keine BreakPilot-Container gefunden."
+            echo "Bitte zuerst deployen (CI/CD Pipeline oder manuell)."
+            echo ""
+            echo "Verfuegbare Container:"
+            docker ps --format "  {{.Names}}" 2>/dev/null || true
+            echo ""
+            echo "Verfuegbare Netzwerke:"
+            docker network ls --format "  {{.Name}}" 2>/dev/null || true
+            exit 1
+          fi
+
+          echo "BreakPilot Netzwerk: $BP_NETWORK"
           echo ""
 
-          echo "--- Container mit 'rag' oder 'compliance' im Namen ---"
-          docker ps --format "{{.Names}} {{.Networks}} {{.Ports}}" 2>/dev/null | grep -iE "rag|compliance" || echo "Keine gefunden"
-          echo ""
+          # Ingestion in einem Container auf dem BP-Netzwerk ausfuehren,
+          # mit Zugriff auf die Scripts aus dem Deploy-Dir
+          docker run --rm \
+            --network "$BP_NETWORK" \
+            -v "${DEPLOY_DIR}/scripts:/workspace/scripts:ro" \
+            -e "WORK_DIR=/tmp/rag-ingestion" \
+            -e "RAG_URL=http://bp-core-rag-service:8097/api/v1/documents/upload" \
+            -e "QDRANT_URL=https://qdrant-dev.breakpilot.ai" \
+            -e "SDK_URL=http://bp-compliance-ai-sdk:8090" \
+            alpine:3.19 \
+            sh -c "
+              apk add --no-cache curl bash coreutils > /dev/null 2>&1
+              mkdir -p /tmp/rag-ingestion/{pdfs,repos,texts}
+              cd /workspace
+              if [ '${PHASE}' = 'all' ]; then
+                bash scripts/ingest-legal-corpus.sh
+              else
+                bash scripts/ingest-legal-corpus.sh --only '${PHASE}'
+              fi
+            "
 
-          echo "--- Netzwerke ---"
-          docker network ls 2>/dev/null || true
           echo ""
-
-          # Finde RAG-Service Port auf dem Host
-          echo "--- Host-Port-Mapping fuer 8097 ---"
-          docker ps --format "{{.Names}} {{.Ports}}" 2>/dev/null | grep "8097" || echo "Kein 8097 Mapping"
-          echo ""
-
-          echo "=== Discovery abgeschlossen ==="
+          echo "=== Ingestion abgeschlossen ==="