Overhaul deployment docs: audit for staleness & document the minimal required env variables

[nolte]

Summary

The deployment documentation has drifted from the current implementation.
Several pages carry outdated or incomplete information — most notably the
minimal required environment variables are not clearly and completely
documented per deployment path. The deployment docs should be thoroughly
audited against the actual code / charts / compose files and rewritten where
needed, keeping the DE-canonical / EN-mirror pairing in sync (per
spec/style-guides/DOCS.md).

Scope — pages to overhaul

docs/de/deployment/** (+ their docs/en/ mirrors) and the dedicated env
reference:

• deployment/index.md (thin, 27 lines — needs a real orientation/overview)
• deployment/docker-installation.md
• deployment/docker-quickstart.md
• deployment/docker-dauerbetrieb.md (Docker Compose permanent operation)
• deployment/kubernetes.md
• deployment/helm.md
• deployment/argocd.md
• deployment/ci-cd.md
• deployment/konfigurationsmatrix.md (Configuration Matrix)
• deployment/betriebsprofile.md (Deployment Profiles — light vs full)
• deployment/inference-service.md
• reference/environment-variables.md (the env-var reference — should be the SSOT)

Known / suspected gaps

• Minimal required env variables are not clearly documented. In particular
  the fail-fast mandatory secrets that crash backend startup when unset —
  e.g. INTERNAL_SERVICE_TOKEN, FERNET_KEY, ERASURE_TOMBSTONE_SALT — must be
  called out per deployment path as required before rollout. The exact current
  set must be verified against the backend startup gate / settings, not
  copied from memory.
• ArangoDB credentials: the relationship ARANGODB_PASSWORD ≡
  ARANGO_ROOT_PASSWORD and the "credentials come from the secret, not inline
  values" rule (a real prod trap) should be documented.
• Home Assistant: HA_URL resolution rules and HA_ALLOW_PRIVATE_ENDPOINT
  (SSRF guard) — when they are needed and what happens if misconfigured (startup
  crash vs HA-optional).
• Light vs full mode: which env vars gate each profile (e.g. light-mode
  bypasses auth/encryption; IDENTIFICATION_EXTERNAL_IN_LIGHT_MODE), and the
  minimal set each profile actually needs.
• Inference / external services: image pin/tag requirements and the env they
  need.
• General: stale commands, stale image/chart references, and missing "what is the
  absolute minimum to get a working deployment" sections.

Approach

1. Audit each page against the real source of truth: backend settings /
   startup validation, the Helm chart values*.yaml, the compose files, and the
   ArgoCD/CI wiring. Flag every stale, missing, or contradictory statement.
2. Rewrite where needed (not just patch) so each deployment path has a clear,
   correct, minimal-to-advanced structure, including an explicit "minimum
   required environment variables" section per path and a complete, verified
   env-var reference table on reference/environment-variables.md.
3. Keep DE canonical, EN mirror strictly in sync; informal "du" voice;
   admonitions per DOCS.md. Prefer generated fact tables where a generator
   exists.
4. Verify with a local mkdocs build --strict and DE/EN heading parity.

Acceptance criteria

• Every deployment/** page audited; stale/incorrect content corrected or
  rewritten.
• Each deployment path (Docker, Compose permanent, Kubernetes, Helm, ArgoCD)
  documents its minimal required env variables, including the fail-fast
  mandatory secrets, verified against the backend startup gate.
• reference/environment-variables.md is a complete, verified reference
  (name, purpose, required/optional, default, which profile needs it).
• DE/EN mirrors in sync (heading parity); mkdocs build --strict green.
• No stale commands, image tags, or chart references remain.

Notes

Best tackled with the mkdocs-documentation agent for the writing, grounded by a
read-only audit of the current backend settings + Helm/compose files first. This
is documentation-only — no code changes.

---

🤖 Filed via Claude Code

[nolte]

Resolved via #667 (merged to develop). Auto-close did not fire because the automerge app merges with an app token; closing manually.