CC2 ↔ Spoolman bridge with NFC tag generator

- Reads /opt/usr/canvas_record_info.json over SSH (pinned host key,
  restricted key), decodes Spoolman spool ids from the tag weight
- Mirrors spools into CC2 Control's spool library and assigns slots,
  keeps its own slot mapping, sets Spoolman locations
- Books the drop of CC2 Control's measured remaining weight to Spoolman
  after each print, idempotent across restarts and interrupted bookings
- Dry-run by default; web UI for settings, SSH key, status and log
- Tag generator for NFC Tools command chains (NTAG213/215/216)
- Tests, mock environment, Dockerfile, Gitea Actions CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014GcEk5tkfFSYD6NTF66NkC

.gitea/workflows/ci.yml

@@ -0,0 +1,97 @@
+name: CI
+
+# Jeder Push und jeder Pull Request: Tests, dann Image-Build.
+# Veröffentlicht wird nur auf main und nur, wenn die Tests grün sind (`needs:`):
+#
+#   Push auf main → :latest, :sha-<kurz>
+#
+# Actions auf Commit-SHAs festgelegt (Kommentar = Version), wie in den anderen Repos.
+on:
+  push:
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Gitea hat keinen Artefakt-Dienst für Build-Records → Upload/Summary abschalten.
+  DOCKER_BUILD_RECORD_UPLOAD: "false"
+  DOCKER_BUILD_SUMMARY: "false"
+  IMAGE: git.menzel.center/menzeljonas/cc2-spoolman-bridge
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12" # wie im Dockerfile
+
+      - name: Abhängigkeiten installieren
+        run: pip install -r requirements-dev.txt
+
+      - name: pytest
+        run: python -m pytest
+
+  image:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Veröffentlichen?
+        id: publish
+        run: |
+          if [[ "$GITHUB_EVENT_NAME" == push && "$GITHUB_REF" == refs/heads/main ]]; then
+            echo "push=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "push=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "short=${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+
+      - name: An der Registry anmelden
+        if: steps.publish.outputs.push == 'true'
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: git.menzel.center
+          username: ${{ gitea.actor }}
+          # Bevorzugt das Repo-Secret REGISTRY_TOKEN (Token mit package: write);
+          # fehlt es, wird der automatische Actions-Token verwendet.
+          password: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
+
+      - name: Bauen (und auf main hochladen)
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          target: runtime
+          platforms: linux/amd64
+          push: ${{ steps.publish.outputs.push == 'true' }}
+          tags: |
+            ${{ env.IMAGE }}:latest
+            ${{ env.IMAGE }}:sha-${{ steps.publish.outputs.short }}
+          build-args: |
+            APP_VERSION=${{ steps.publish.outputs.short }}
+          labels: |
+            org.opencontainers.image.title=cc2-spoolman-bridge
+            org.opencontainers.image.source=https://git.menzel.center/menzeljonas/cc2-spoolman-bridge
+            org.opencontainers.image.revision=${{ github.sha }}
+          # Registry-Cache: der Gitea-Runner hat keinen Actions-Cache-Dienst.
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: ${{ steps.publish.outputs.push == 'true' && format('type=registry,ref={0}:buildcache,mode=max', env.IMAGE) || '' }}
+          provenance: false
+
+      - name: Hinweis bei fehlgeschlagener Anmeldung
+        if: failure() && steps.publish.outputs.push == 'true'
+        run: |
+          {
+            echo "Build oder Push nach git.menzel.center fehlgeschlagen."
+            echo ""
+            echo "Bei 'unauthorized'/'denied' ein Repo-Secret **REGISTRY_TOKEN** anlegen:"
+            echo "1. Benutzereinstellungen → Anwendungen → Neuen Token erzeugen, *package*: Lesen und Schreiben"
+            echo "2. Repository → Einstellungen → Actions → Secrets → REGISTRY_TOKEN"
+          } >> "$GITHUB_STEP_SUMMARY"