feat: manual deploy-app workflow for apps/ with build support

Add workflow_dispatch-only deploy-app action, deploy-app.sh script,
apps/_template for Cursor, and SOUL/README split between static
webhook deploy and app compose profiles.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/_template/README.md

@@ -0,0 +1,47 @@
+# App template (`apps/<slug>/`)
+
+Cursor copies this folder when creating a non-trivial app (npm, Docker, database).
+
+## Layout
+
+```
+apps/<slug>/
+├── Dockerfile
+├── package.json      # optional — Node apps
+├── package-lock.json
+└── src/              # or project-specific layout
+```
+
+## `compose.yml` — add a profile
+
+Append a service (replace `<slug>`):
+
+```yaml
+  <slug>:
+    profiles: ["<slug>"]
+    build: ./apps/<slug>
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.<slug>.rule=Host(`playground.schwenk.online`) && PathPrefix(`/<slug>`)"
+      - "traefik.http.routers.<slug>.entrypoints=websecure"
+      - "traefik.http.routers.<slug>.tls.certresolver=myresolver"
+      - "traefik.http.services.<slug>.loadbalancer.server.port=3000"
+    networks:
+      - traefik
+```
+
+Adjust port and PathPrefix to match the app. For Postgres/SQLite, add volumes and env in the same profile block.
+
+## Deploy workflow
+
+**Default:** use the shared manual workflow `.gitea/workflows/deploy-app.yml` (`workflow_dispatch`, input `app=<slug>`).
+
+**Optional (stricter):** copy `workflow-deploy.yml.template` to `.gitea/workflows/deploy-<slug>.yml` — triggers **only** manually for that app.
+
+## After implementation
+
+1. Push to `main` (static webhook updates repo files only — does **not** build the app).
+2. Gitea → Actions → **Deploy App (manual)** → Run workflow → `app` = `<slug>`.
+
+Comment in the issue: *„App unter apps/<slug>/ — bitte Workflow Deploy App manuell starten.“*