feat: Add DevSecOps tools, Woodpecker proxy, Vault persistent storage, pitch-deck annex slides

- Install Gitleaks, Trivy, Grype, Syft, Semgrep, Bandit in backend-core Dockerfile
- Add Woodpecker SQLite proxy API (fallback without API token)
- Mount woodpecker_data volume read-only to backend-core
- Add backend proxy fallback in admin-core Woodpecker route
- Add Vault file-based persistent storage (config.hcl, init-vault.sh)
- Auto-init, unseal and root-token persistence for Vault
- Add 6 pitch-deck annex slides (Assumptions, Architecture, GTM, Regulatory, Engineering, AI Pipeline)
- Dynamic margin/amortization KPIs in BusinessModelSlide
- Market sources modal with citations in MarketSlide
- Redesign nginx landing page to 3-column layout (Lehrer/Compliance/Core)
- Extend MkDocs nav with Services and SDK documentation sections
- Add SDK Protection architecture doc

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pitch-deck/lib/hooks/useSlideNavigation.ts

@@ -17,6 +17,12 @@ const SLIDE_ORDER: SlideId[] = [
   'financials',
   'the-ask',
   'ai-qa',
+  'annex-assumptions',
+  'annex-architecture',
+  'annex-gtm',
+  'annex-regulatory',
+  'annex-engineering',
+  'annex-aipipeline',
 ]
 
 export const TOTAL_SLIDES = SLIDE_ORDER.length

pitch-deck/lib/i18n.ts

@@ -21,6 +21,10 @@ const translations = {
       'Finanzen',
       'The Ask',
       'KI Q&A',
+      'Anhang: Annahmen',
+      'Anhang: Architektur',
+      'Anhang: Go-to-Market',
+      'Anhang: Regulatorik',
     ],
     cover: {
       tagline: 'Datensouveraenitaet meets KI-Compliance',
@@ -190,6 +194,32 @@ const translations = {
         'Warum Self-Hosting statt Cloud?',
       ],
     },
+    annex: {
+      assumptions: {
+        title: 'Annahmen & Sensitivitaet',
+        subtitle: 'Drei Szenarien fuer robuste Planung',
+      },
+      architecture: {
+        title: 'Technische Architektur',
+        subtitle: 'Self-Hosted KI-Stack fuer maximale Datensouveraenitaet',
+      },
+      gtm: {
+        title: 'Go-to-Market Strategie',
+        subtitle: 'Vom Pilot zum skalierbaren Vertrieb',
+      },
+      regulatory: {
+        title: 'Regulatorische Details',
+        subtitle: 'Die drei Saeulen der EU-Compliance',
+      },
+      engineering: {
+        title: 'Engineering Deep Dive',
+        subtitle: '691K Zeilen Code \u00b7 45 Container \u00b7 100% Self-Hosted',
+      },
+      aipipeline: {
+        title: 'KI-Pipeline Deep Dive',
+        subtitle: 'RAG \u00b7 Multi-Agent-System \u00b7 Document Intelligence \u00b7 Quality Assurance',
+      },
+    },
   },
   en: {
     nav: {
@@ -211,6 +241,10 @@ const translations = {
       'Financials',
       'The Ask',
       'AI Q&A',
+      'Appendix: Assumptions',
+      'Appendix: Architecture',
+      'Appendix: Go-to-Market',
+      'Appendix: Regulatory',
     ],
     cover: {
       tagline: 'Data Sovereignty meets AI Compliance',
@@ -380,6 +414,32 @@ const translations = {
         'Why self-hosting instead of cloud?',
       ],
     },
+    annex: {
+      assumptions: {
+        title: 'Assumptions & Sensitivity',
+        subtitle: 'Three scenarios for robust planning',
+      },
+      architecture: {
+        title: 'Technical Architecture',
+        subtitle: 'Self-hosted AI stack for maximum data sovereignty',
+      },
+      gtm: {
+        title: 'Go-to-Market Strategy',
+        subtitle: 'From pilot to scalable sales',
+      },
+      regulatory: {
+        title: 'Regulatory Details',
+        subtitle: 'The three pillars of EU compliance',
+      },
+      engineering: {
+        title: 'Engineering Deep Dive',
+        subtitle: '691K Lines of Code \u00b7 45 Containers \u00b7 100% Self-Hosted',
+      },
+      aipipeline: {
+        title: 'AI Pipeline Deep Dive',
+        subtitle: 'RAG \u00b7 Multi-Agent System \u00b7 Document Intelligence \u00b7 Quality Assurance',
+      },
+    },
   },
 }
 

pitch-deck/lib/types.ts

@@ -214,3 +214,9 @@ export type SlideId =
   | 'financials'
   | 'the-ask'
   | 'ai-qa'
+  | 'annex-assumptions'
+  | 'annex-architecture'
+  | 'annex-gtm'
+  | 'annex-regulatory'
+  | 'annex-engineering'
+  | 'annex-aipipeline'