Add phase 6: backup/restore scripts and full README

- backup.sh: pg_dump (custom format), media volume and .env in one
  archive with retention (KEEP), cron example
- restore.sh: confirmation, restores .env if missing, pg_restore
  --clean in one transaction, replaces media, restarts the app
- Fix: MEDIA_ROOT=/data/media in the image so photos land on the volume
- README: installation, Nginx/Cloudflare client-IP setup, configuration
  table, AI and Instagram notes, update, backup, troubleshooting, security
- Test settings independent of the local .env

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CLAUDE.md

@@ -10,7 +10,7 @@ port; TLS, domain and proxy are out of scope.
 - [x] Phase 3: Comments, serving calculator (server-side `?portionen=`), cooking mode (wake lock)
 - [x] Phase 4: AI (OpenAI): "Mit KI aufbereiten" on the form + photo/screenshot and text import
 - [x] Phase 5: Link import (schema.org JSON-LD, Instagram best effort + paste/screenshot fallback, PWA share target)
-- [ ] Phase 6: Backup script, full README
+- [x] Phase 6: Backup/restore scripts, full README
 
 ## Stack
 Django 5.2 LTS (Python 3.12), server-rendered templates, PostgreSQL 17,
@@ -45,7 +45,9 @@ no JS build step: plain forms with small progressive enhancements in `static/js/
   `scripts/make_icons.py`.
 - `templates/`, `static/` – global templates, `app.css` (mobile first, dark mode), `app.js`.
 - `docker/entrypoint.sh` – migrate → ensure_admin → purge_ratelimits → gunicorn.
-- `scripts/` – `init-env.sh` (creates .env with secrets), `dev_server.py` (local run without Docker).
+- `scripts/` – `init-env.sh` (creates .env with secrets), `backup.sh` / `restore.sh` (pg_dump + media + .env
+  in one archive, retention via KEEP), `dev_server.py` (local run without Docker), `make_icons.py`.
+- In the container `MEDIA_ROOT=/data/media` (volume `media`); never change without migrating files.
 
 ## Commands
 ```bash