Harden API uptime with systemd ownership guard and watchdog

docs/wiki/Deployment.md

@@ -7,6 +7,7 @@ Zielplattform aktuell: Hetzner + CloudPanel + Nginx + systemd.
 - App-Code: `/opt/staysense`
 - API-Service: `staysense-api.service`
 - Import-Timer: `staysense-import.timer`
+- API-Watchdog: `staysense-watchdog.timer`
 - Frontend-Root: `/home/staysense-site/htdocs/staysense.vanityontour.de/`
 
 ## Rollout (vereinfacht)
@@ -17,12 +18,14 @@ git pull --ff-only
 rsync -a --delete /opt/staysense/src/ /home/staysense-site/htdocs/staysense.vanityontour.de/
 systemctl restart staysense-api.service
 nginx -t && systemctl reload nginx
+systemctl restart staysense-watchdog.timer
 ```
 
 ## Pflichtchecks
 
 ```bash
 systemctl is-active staysense-api.service
+systemctl is-active staysense-watchdog.timer
 curl -s -L https://staysense.vanityontour.de/api/health
 ```
 

docs/wiki/Operations-Runbook.md

@@ -5,6 +5,7 @@
 ```bash
 systemctl status staysense-api.service --no-pager
 systemctl status staysense-import.timer --no-pager
+systemctl status staysense-watchdog.timer --no-pager
 curl -s https://staysense.vanityontour.de/api/health
 ```
 
@@ -13,6 +14,7 @@ curl -s https://staysense.vanityontour.de/api/health
 ```bash
 journalctl -u staysense-api.service --no-pager -n 120
 journalctl -u staysense-import.service --no-pager -n 120
+journalctl -u staysense-watchdog.service --no-pager -n 120
 ```
 
 ## Häufige Fehlerbilder
@@ -25,6 +27,12 @@ journalctl -u staysense-import.service --no-pager -n 120
 - Datenverzeichnisrechte prüfen
 - Service-User und Besitzrechte prüfen
 
+```bash
+chown -R staysense:staysense /opt/staysense/data
+chmod 2775 /opt/staysense/data
+systemctl restart staysense-api.service
+```
+
 3. Importdaten veraltet
 - Timer-Status prüfen
 - Import-Service manuell starten