feat: add weblink playlists, SSH player deployment, Caddy HTTPS, build player page

- Content model: add url column + is_weblink() for web page content items
- Player model: add deployment tracking fields (status, timestamps, message)
- Content blueprint: add add_weblink and add_weblink_to_playlist routes;
  weblinks auto-deleted when removed from playlist
- Players blueprint: add SSH deploy mode in add_player; weblink-aware playlist
- API blueprint: weblink URL served directly in playlist response;
  add /api/deploy/test-ssh and /api/deploy/player endpoints
- Admin blueprint: add build-player page (clone from Gitea, write base config);
  replace nginx status card with Caddy status on HTTPS config page
- caddy_manager: rewritten to generate proper HTTPS/internal-CA Caddyfiles
  and reload Caddy via admin API (/load) for live config updates
- ssh_deploy, background_tasks, player_build: new utils for SSH deployment
- background_tasks: push Flask app context into background thread so DB
  updates after deployment complete correctly
- ssh_deploy: robust install script detection with passwordless sudo injection
  (uses SSH credentials, cleaned up after install)
- Dockerfile: add git, sshpass, openssh-client, rsync
- docker-compose: switch nginx to Caddy on ports 80/443; add port 5000 for dev
- Templates: add_player deploy mode UI, weblink form in playlist/upload pages,
  build_player admin page, Caddy status on HTTPS config page
- Migrations: add_url_to_content, add_deployment_fields_to_player
- app.py: call db.create_all() on startup for schema bootstrap
- config.py: add PLAYER_CODE_DIR and PLAYER_REPO_URL settings

docker-compose.yml

@@ -5,8 +5,11 @@ services:
     build: .
     container_name: digiserver-v2
     # Don't expose directly; use Caddy reverse proxy instead
+    # Port 5000 is also mapped directly for dev/testing access when Caddy isn't running
     expose:
       - "5000"
+    ports:
+      - "5000:5000"
     volumes:
       # Code is in the Docker image - no volume mount needed
       # Only mount persistent data folders:
@@ -27,22 +30,18 @@ services:
     networks:
       - digiserver-network
 
-  # Nginx reverse proxy with HTTPS support
-  nginx:
-    image: nginx:alpine
-    container_name: digiserver-nginx
+  # Caddy reverse proxy — auto-provisions Let's Encrypt certs when a real domain is configured
+  caddy:
+    image: caddy:2-alpine
+    container_name: digiserver-caddy
     ports:
-      - "80:80"
-      - "443:443"
+      - "8080:80"
+      - "8443:443"
     volumes:
-      - ./data/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./data/nginx-custom-domains.conf:/etc/nginx/conf.d/custom-domains.conf:rw
-      - ./data/nginx-ssl:/etc/nginx/ssl:ro
-      - ./data/nginx-logs:/var/log/nginx
-      - ./data/certbot:/var/www/certbot:ro  # For Let's Encrypt ACME challenges
-    environment:
-      - DOMAIN=${DOMAIN:-localhost}
-      - EMAIL=${EMAIL:-admin@localhost}
+      - ./data/Caddyfile:/etc/caddy/Caddyfile:rw
+      - ./data/caddy-data:/data
+      - ./data/caddy-config:/config
+      - ./data/caddy-logs:/var/log/caddy
     depends_on:
       digiserver-app:
         condition: service_started