feat(gitsync): synka wiki-repot mot remote över SSH

- ed25519-deploy-nyckel genereras av servern (config-volymen, 0600),
  GIT_SSH_COMMAND med egen known_hosts (accept-new)
- inställningar: remote-URL, live-gren, read-only, auto-synk-intervall
- bakgrundssynk: endast fast-forward, flaggar attention vid merge-behov
- pull/push, skapa/byt gren, merge-popup (ours/theirs per fil eller allt),
  abort, reset från remote med automatisk backup-gren
- headless-konfig via config.json eller updateGitSync-mutationen
- openssh-client tillagd i runtime-imagen; mutex kring alla git-operationer

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/config/config.go

@@ -19,6 +19,36 @@ type Config struct {
 	// (e.g. https://archivum.brasse-pc.eu). Used to build the OIDC
 	// redirect URL when one is not set explicitly.
 	PublicURL string `json:"public_url"`
+	GitSync   GitSyncConfig `json:"git_sync"`
+}
+
+// GitSyncConfig configures synchronisation of the wiki git repository
+// with a remote (SSH or HTTPS). The SSH keypair is generated by the
+// server itself and lives next to config.json so the whole feature can
+// be driven headlessly by editing config.json and restarting.
+type GitSyncConfig struct {
+	Enabled   bool   `json:"enabled"`
+	RemoteURL string `json:"remote_url"` // e.g. ssh://git@git.brasse-pc.eu:2222/brasse/Archivum-documets.git
+	// LiveBranch is the branch that counts as the live content of this
+	// instance: auto-sync pulls/pushes it and resets target it.
+	LiveBranch string `json:"live_branch"`
+	// ReadOnly forbids every push to the remote; the instance only
+	// pulls. Local edits still commit locally.
+	ReadOnly bool `json:"read_only"`
+	// AutoSyncMinutes > 0 enables background sync on that interval.
+	// Background pulls are fast-forward only; anything needing a real
+	// merge is left for an admin to resolve in the UI.
+	AutoSyncMinutes int `json:"auto_sync_minutes"`
+}
+
+// Normalize fills in defaults for optional git-sync fields.
+func (g *GitSyncConfig) Normalize() {
+	if g.LiveBranch == "" {
+		g.LiveBranch = "main"
+	}
+	if g.AutoSyncMinutes < 0 {
+		g.AutoSyncMinutes = 0
+	}
 }
 
 type LDAPConfig struct {
@@ -105,6 +135,7 @@ func Load(path string) (*Config, error) {
 	}
 
 	cfg.OIDC.Normalize()
+	cfg.GitSync.Normalize()
 
 	return &cfg, nil
 }