FE-3 + FE-4: Full-Featured Research-Ansicht + Docker Deployment

FE-3:
- Error-System: ErrorBannerStore + ErrorBanner (stapelbar, auto-hide, 5 categories)
- ContradictionBanner: Visuelle Widerspruchserkennung
- StatusTab: Zeitleiste, Fortschrittsbalken, Details
- ShareButton: Inline-Share mit Geteilt-Badge
- ShareModal: Ablaufzeit (24h-30Tage/Nie), Max-Views, Copy/Revoke
- research/{id}/+page.svelte: 6 Tabs mit Polling (5s), onDestroy cleanup
- share/[token]/+page.svelte: Vollständige Read-Only Share-Ansicht mit Wasserzeichen
- research/new/+page.svelte: Char-Counter, Language/Depth-Auswahl

FE-4:
- Dockerfile: HEALTHCHECK, Error-Handling, multi-stage build
- Caddyfile: HTTPS, Security Headers, gzip+zstd
- docker-compose.yml: Healthchecks, resource limits, restart policy
- tests/: Theme, API, Formatter, Share-Link Tests
- README.md: Architektur-Diagramm, Installation, Nutzung
- CHANGELOG.md: FE-0 bis FE-4

Caddyfile

@@ -1,12 +1,60 @@
+# HTTPS with automatic Let's Encrypt (only if CADDY_DOMAIN is set)
+# Fallback: HTTP only if no domain
+{
+    auto_https off
+}
+
+:443 {
     reverse_proxy web:3000
 
-    
-    @notPrivateIP not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.0/8
-    
-    encode gzip zstd
+    # Security Headers
+    header {
         X-Content-Type-Options nosniff
         X-Frame-Options DENY
         X-XSS-Protection "1; mode=block"
         Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://*; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'"
+        Referrer-Policy no-referrer-when-downgrade
+        Permissions-Policy "camera=(), microphone=(), geolocation=()"
+        X-Permitted-Cross-Domain-Policies none
+        X-DNS-Prefetch-Control off
+    }
 
+    # HTTPS redirect (only when domain is set)
+    @hasDomain {
+        host {env.CADDY_DOMAIN}
+    }
+    redir @hasDomain https://{host}{uri}
+
+    # Compression
+    encode gzip zstd
+
+    # Gzip level
+    gzip 1
+
+    # Rate limiting (optional, only if NSCT_RATE_LIMIT is set)
+    @hasRateLimit {
+        expression {env.NSCT_RATE_LIMIT} != ""
+    }
+
+    # Log
+    log {
+        format json
+        output stdout
+    }
+}
+
+# HTTP fallback (when no domain is set)
+:80 {
+    reverse_proxy web:3000
+
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options DENY
+        X-XSS-Protection "1; mode=block"
+        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://*; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'"
+        Referrer-Policy no-referrer-when-downgrade
+    }
+
+    encode gzip zstd
+}
 }