feat: Admin-Seite mit Passwortaenderung und Regel-Neuanwendung

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

create_pod_finance.sh

@@ -212,6 +212,12 @@ podman exec "$DB_CTR_NAME" psql -U finance -d finance -c \
 echo "Role 'finance_read' is ready."
 
 # API container (runs alembic upgrade head on start via entrypoint.sh)
+# The extra "-v $ENV_FILE:/data/.env:Z" below (Ausbaustufe 4 Task 2, Admin
+# password change) is a SINGLE-FILE bind mount. Unlike a directory mount,
+# this follows the host file's INODE: the app must read/write it in place
+# (open r+/truncate under flock - see app/services/admin.py), NEVER via
+# temp-file+rename, because a rename would swap in a new inode that the
+# already-running mount no longer points at.
 podman run -d --name "$API_CTR_NAME" --pod "$POD_NAME" \
   -e FB_DATABASE_URL="postgresql+psycopg://finance:$POSTGRES_PASSWORD@localhost:5432/finance" \
   -e FB_API_KEY \
@@ -221,6 +227,7 @@ podman run -d --name "$API_CTR_NAME" --pod "$POD_NAME" \
   -e FB_INBOX_DIR=/data/inbox \
   -e FB_UPLOADS_DIR=/data/uploads \
   -v "$DATA_DIR:/data:Z" \
+  -v "$ENV_FILE:/data/.env:Z" \
   "$API_IMAGE"
 echo "Container '$API_CTR_NAME' started (rc=$?)"