feat: repo permission system + Gitea-only provisioning + env templates

Schema:
- AllowedRepo model: admin-controlled list of deployable repos
  - giteaOwner/giteaRepo: always from Gitea (git.dfmpanel.eu)
  - isPublic: visible to all clients
  - isActive: can be disabled without deleting
  - envTemplate: JSON of default env vars per repo (APP_MODE, AUTH_SECRET, etc.)
- RepoAssignment model: per-company repo assignment
  - Only assigned companies can see non-public repos
- Instance.allowedRepoId: links instance to its source repo

Provisioning changes:
- Always uses Gitea (gitProvider: 'gitea'), never GitHub
- Branch is always 'main'
- Repo URL: {GITEA_URL}/{owner}/{repo}.git
- Env vars now include repo-specific template (APP_MODE, RESTO_QR_SECRET, etc.)
  merged with AOS license vars and caller overrides
- Permission check: repo must be public OR assigned to the company

API:
- GET /api/aos/repos — list all (admin) or client-scoped (?companyId=X)
- POST /api/aos/repos — add a repo to allowed list
- PATCH /api/aos/repos/[id] — update + assign/unassign to company
- DELETE /api/aos/repos/[id] — remove (blocked if instances exist)

Seed:
- restov1 added as public allowed repo with env template:
  APP_MODE=demo, RESTO_RESTAURANT_ID, RESTO_QR_SECRET, AUTH_SECRETs

Env:
- GITEA_URL=https://git.dfmpanel.eu added to .env + .env.example

prisma/schema.prisma

@@ -106,6 +106,7 @@ model Company {
   tickets       Ticket[]
   agencyApplication AgencyApplication?
   instances     Instance[]
+  repoAssignments RepoAssignment[]
 }
 
 model Person {
@@ -953,6 +954,8 @@ model Instance {
   metadata        String?  // JSON: { gitRepo, gitBranch, imageTag, resources }
   lastError       String?
   lastErrorAt     DateTime?
+  allowedRepoId   String?
+  allowedRepo     AllowedRepo? @relation(fields: [allowedRepoId], references: [id])
   createdAt       DateTime @default(now())
   updatedAt       DateTime @updatedAt
   events          InstanceEvent[]
@@ -984,3 +987,40 @@ model ProvisioningJob {
   createdAt   DateTime @default(now())
   updatedAt   DateTime @updatedAt
 }
+
+// ---------------------------------------------------------------------------
+// Allowed Repos (admin controls which Gitea repos clients can deploy)
+// ---------------------------------------------------------------------------
+// Admin selects which repos are available for instance provisioning.
+// Repos can be:
+//   - public: visible to all clients in the "Neue Instanz" dialog
+//   - assigned: only visible to specific companies (per-company assignment)
+// Unfinished/custom projects are NOT shared unless explicitly assigned.
+model AllowedRepo {
+  id          String   @id @default(cuid())
+  giteaOwner  String   // e.g. "dfmsolutions" (Gitea org/user)
+  giteaRepo   String   // e.g. "restov1" (repo name)
+  displayName String   // human-readable: "Pizzeria RESTO (restov1)"
+  description String?  // what this product does
+  product     String   // product slug: "restov1", "aos-cms", etc.
+  isPublic    Boolean  @default(false) // true = all clients can see it
+  isActive    Boolean  @default(true)  // false = hidden from all
+  envTemplate String?  // JSON: default env vars for this repo
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+  assignments RepoAssignment[]
+  instances   Instance[]  // instances created from this repo
+
+  @@unique([giteaOwner, giteaRepo])
+}
+
+model RepoAssignment {
+  id           String      @id @default(cuid())
+  allowedRepoId String
+  allowedRepo   AllowedRepo @relation(fields: [allowedRepoId], references: [id], onDelete: Cascade)
+  companyId    String      // which company can use this repo
+  company      Company     @relation(fields: [companyId], references: [id], onDelete: Cascade)
+  createdAt    DateTime @default(now())
+
+  @@unique([allowedRepoId, companyId])
+}