Back office: Postgres source-of-truth + read dashboard

Stand up the DB-first CRM backbone (architecture pivot: Postgres is the
source of truth, Google Sheets becomes a one-way downstream mirror).

- backoffice/ stack: smb-db (Postgres 16) + smb-crm (Flask/waitress service).
- Schema mirrors the six Sheet tabs (clients, leads, projects, activity_log,
  bookings, invoices) with typed columns + updated_at triggers.
- Service-account Sheets client (PyJWT) for the one-time import + future mirror.
- import_from_sheets.py: idempotent seed of Postgres from the live Sheets.
- Read dashboard (Leads & Clients tables) at onboard.mivanchenko.de/crm,
  behind the existing Caddy basic-auth; JSON API reads straight from Postgres.

Deployed + verified: import seeded DB, dashboard/API live, no-auth blocked,
onboarding form unaffected. Add/edit/delete + DB->Sheets sync + n8n ingest
swap are the next steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backoffice/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  smb-db:
+    image: postgres:16-alpine
+    container_name: smb-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: smbcrm
+      POSTGRES_USER: smbcrm
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+    volumes:
+      - smb-db-data:/var/lib/postgresql/data
+      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    networks: [smb-net]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U smbcrm -d smbcrm"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  smb-crm:
+    build: ./app
+    container_name: smb-crm
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://smbcrm:${DB_PASSWORD}@smb-db:5432/smbcrm
+      CRM_API_TOKEN: ${CRM_API_TOKEN}
+      SHEET_ID: ${SHEET_ID}
+      GOOGLE_SA_JSON: /run/secrets/gcp-sa.json
+    volumes:
+      - ./secrets/gcp-sa.json:/run/secrets/gcp-sa.json:ro
+    depends_on:
+      smb-db:
+        condition: service_healthy
+    networks: [smb-net, proxy]
+
+volumes:
+  smb-db-data:
+
+networks:
+  smb-net:
+  proxy:
+    external: true