Backend Phase C: Sync-Kern + Caddy behind-proxy

Sync-Kern:
- internal/sync/hlc.go: Hybrid Logical Clock (wall_ms<<16|counter)
  Tick/Now/After, global mutex, strikt monoton + kausal korrekt
- internal/sync/hlc_test.go: Unit-Tests (monoton, kausal, keine Duplikate)

Store-Schicht:
- internal/store/opstore.go: AppendOps idempotent via UNIQUE(client_id,
  client_seq) ON CONFLICT DO NOTHING; LWW-Projektion (list_create/
  rename/delete, item_add/update/remove) in derselben Transaktion;
  PullOps mit Cursor (seq > since, 500er Pages)
- internal/store/liststore.go: CreateList / GetLists / GetList
- internal/store/itemstore.go: GetItems (nicht-gelöschte Items)
- internal/store/suggeststore.go: Search (pg_trgm + LIKE-fallback, 10)

HTTP-Handler:
- internal/httpapi/lists.go: GET/POST /api/lists, GET /api/lists/{id}
- internal/httpapi/ops.go: POST /api/lists/{id}/ops (Push),
  GET /api/lists/{id}/ops (Pull ?since=)
- internal/httpapi/suggest.go: GET /api/suggestions?q=
- internal/httpapi/api.go: alle Routen verdrahtet (RequireAuth)

Deployment:
- deploy/Caddyfile.behind-proxy: auto_https off, trusted_proxies
- deploy/Caddyfile: X-Forwarded-Proto hinzugefügt, Kommentar aktualisiert
- deploy/docker-compose.yml: CADDY_HTTP_PORT + CADDY_HTTPS_PORT
- deploy/.env.example: Caddy-Port-Variablen dokumentiert

go build ./... && go vet ./... && go test ./... ✅
HLC-Tests: monoton, kausal, keine Duplikate ✅
AGENTS.md: Phase C vollständig ✅

AGENTS.md

@@ -97,12 +97,24 @@ mitbringsl/
 │   │   │   ├── session.go             # SessionStore: opaque Tokens, SHA-256-Hash, Create/Lookup/Revoke
 │   │   │   ├── oidc.go                # OIDCService: id_token-Verifikation (JWKS/iss/aud/exp), Provider-Caching
 │   │   │   └── pgcode.go              # isUniqueViolation (SQLSTATE 23505)
+│   │   ├── sync/                      # PHASE C – Hybrid Logical Clock
+│   │   │   ├── hlc.go                 # HLC: Tick/Now/After, wall_ms<<16|counter, global mutex
+│   │   │   └── hlc_test.go            # HLC Unit-Tests (monoton, kausal, keine Duplikate)
+│   │   ├── store/                     # PHASE C – Store-Schicht
+│   │   │   ├── db.go                  # pgxpool-Setup
+│   │   │   ├── opstore.go             # AppendOps (idempotent, LWW-Projektion), PullOps (cursor)
+│   │   │   ├── liststore.go           # CreateList/GetLists/GetList
+│   │   │   ├── itemstore.go           # GetItems
+│   │   │   └── suggeststore.go        # Search (pg_trgm fuzzy)
 │   │   └── httpapi/
-│   │       ├── api.go                 # API-Objekt + Router (Health + /auth/* aktiv, Rest auskommentiert)
+│   │       ├── api.go                 # API-Objekt + Router (alle Routen aktiv)
 │   │       ├── render.go              # JSON-Render + Problem + Fehler-Sentinale + decodeJSON
 │   │       ├── middleware.go          # requestID/logging/recover/cors + Chain
 │   │       ├── health.go              # /healthz + /readyz
-│   │       └── auth.go                # Register/Login/Logout/OIDC-Handler + RequireAuth-Middleware
+│   │       ├── auth.go                # Register/Login/Logout/OIDC-Handler + RequireAuth-Middleware
+│   │       ├── lists.go               # GET/POST /api/lists, GET /api/lists/{id}
+│   │       ├── ops.go                 # POST/GET /api/lists/{id}/ops (Push/Pull)
+│   │       └── suggest.go             # GET /api/suggestions?q=
 │   ├── migrations/
 │   │   ├── embed.go                   # //go:embed *.sql
 │   │   ├── 000001_init_schema.up.sql  # users/sessions/lists/list_members/items/op_log/item_names
@@ -111,9 +123,10 @@ mitbringsl/
 │   ├── .dockerignore
 │   ├── go.mod / go.sum
 ├── deploy/
-│   ├── docker-compose.yml             # caddy + backend + migrate + db (mit YAML-anchors)
-│   ├── Caddyfile                      # auto-HTTPS
-│   ├── .env.example                   # alle env-Vars dokumentiert
+│   ├── docker-compose.yml             # caddy + backend + migrate + db (CADDY_HTTP/HTTPS_PORT)
+│   ├── Caddyfile                      # standalone: auto-HTTPS (Let's Encrypt)
+│   ├── Caddyfile.behind-proxy         # hinter externem Reverse Proxy: auto_https off, trusted_proxies
+│   ├── .env.example                   # alle env-Vars dokumentiert inkl. Caddy-Ports
 │   └── db/init/001_extensions.sql     # CREATE EXTENSION pgcrypto, pg_trgm
 ├── docs/                              # NOCH LEER (folgt Phase F)
 └── android/                           # NOCH LEER (folgt Phase D)
@@ -142,9 +155,15 @@ Legende: ✅ erledigt · 🚧 in Arbeit · ⬜ offen
       **Verifiziert:** E2E-Flow gegen lokalen Mock-IdP (Discovery → JWKS → signiertes id_token
       → User angelegt → 2. Login findet gleichen User → tampered Token → 401). Alle Fehlerpfade
       geprüft (disabled→400, unknown provider→400, missing fields→400, invalid→401).
-- ⬜ **Phase C – Sync-Kern:** `op_log`-Append (idempotent), HLC, Projektion op→items/lists (LWW+Tombstones).
-- ⬜ **Phase C – Endpoints:** `/api/lists`, `/api/lists/{id}/ops` (push+pull).
-- ⬜ **Phase C – Suggestions:** `item_names`-Trigger + `/api/suggestions`.
+- ✅ **Phase C – Sync-Kern:** HLC (`internal/sync/hlc.go`), `op_log`-Append idempotent mit
+      LWW-Projektion (items/lists) + Tombstones. `internal/store/opstore.go`.
+      **Verifiziert:** `go build/vet/test ./...` grün. HLC-Tests (monoton, kausal, keine Duplikate).
+- ✅ **Phase C – Endpoints:** `GET/POST /api/lists`, `GET /api/lists/{id}`,
+      `POST/GET /api/lists/{id}/ops` (Push idempotent + Pull mit Cursor `?since=`).
+- ✅ **Phase C – Suggestions:** `suggeststore.go` (pg_trgm fuzzy), `GET /api/suggestions?q=`,
+      `upsertItemName` in Projektion (innerhalb Push-Transaktion).
+- ✅ **Phase C – Caddy:** `Caddyfile.behind-proxy` (auto_https off, trusted_proxies),
+      `CADDY_HTTP_PORT`/`CADDY_HTTPS_PORT` in docker-compose.
 - ⬜ **Phase D – Android-Fundament:** Gradle (Kotlin DSL, Version Catalog, Hilt/KSP, Compose BOM),
       Theme, Nav, Room.
 - ⬜ **Phase D – Repository + Retrofit-API + DTOs.**
@@ -155,24 +174,27 @@ Legende: ✅ erledigt · 🚧 in Arbeit · ⬜ offen
 - ⬜ **Phase F – README + docs** (ARCHITECTURE/SYNC/API).
 
 ### Wo genau weitermachen?
-**Phase B ist komplett ✅. Nächster Schritt = Phase C (Sync-Kern).**
+**Phase C ist komplett ✅. Nächster Schritt = Phase D (Android-Fundament).**
 
-Phase B erledigt:
-- ✅ `internal/auth/password.go` – Argon2id im PHC-Format (HashPassword/VerifyPassword).
-- ✅ `internal/auth/user.go` – UserStore (CreateUser/GetByEmail/GetByID/GetByOIDCSubject/CreateOIDCUser).
-- ✅ `internal/auth/session.go` – SessionStore (crypto/rand + base64url + SHA-256, Create/Lookup/Revoke).
-- ✅ `internal/auth/oidc.go` – OIDCService (id_token-Verifikation via go-oidc v3, Provider-Caching).
-- ✅ `internal/httpapi/auth.go` – Register/Login/Logout/OIDC + RequireAuth-Middleware.
-- ✅ `config.go` – OIDC-Validierung (enabled → client_id/issuer Pflicht).
-- ✅ Alle `/auth/*`-Routen aktiv verdrahtet.
+Phase C erledigt:
+- ✅ `internal/sync/hlc.go` – HLC (wall_ms<<16|counter, Tick/Now/After, global mutex).
+- ✅ `internal/store/opstore.go` – AppendOps idempotent (ON CONFLICT DO NOTHING), LWW-Projektion
+  (list_create/rename/delete, item_add/update/remove), PullOps (cursor, 500er Pages).
+- ✅ `internal/store/liststore.go` – CreateList / GetLists / GetList (owner-check MVP).
+- ✅ `internal/store/itemstore.go` – GetItems (nicht-gelöschte Items einer Liste).
+- ✅ `internal/store/suggeststore.go` – Search (pg_trgm fuzzy, LIKE-fallback, 10 Ergebnisse).
+- ✅ `internal/httpapi/lists.go` – GET/POST /api/lists, GET /api/lists/{id} + Items.
+- ✅ `internal/httpapi/ops.go` – POST /api/lists/{id}/ops (Push), GET /api/lists/{id}/ops (Pull).
+- ✅ `internal/httpapi/suggest.go` – GET /api/suggestions?q=.
+- ✅ `internal/httpapi/api.go` – alle Routen verdrahtet.
+- ✅ `deploy/Caddyfile.behind-proxy` – auto_https off + trusted_proxies.
+- ✅ `deploy/docker-compose.yml` – CADDY_HTTP_PORT / CADDY_HTTPS_PORT.
 
-Phase C – Sync-Kern (offen):
-1. `internal/sync/hlc.go` – Hybrid Logical Clock (client- + server-seitig, `(ts, counter)`).
-2. `op_log`-Append in `internal/store/opstore.go`: `AppendOp` idempotent via `UNIQUE(client_id, client_seq)`,
-   zurück: server-seitiger `seq` + `now()`-basierte HLC.
-3. Projektion op→items/lists: `internal/store/liststore.go`/`itemstore.go` mit LWW (`hlc_ts`) + Tombstones (`deleted_at`).
-4. Endpoints `GET/POST /api/lists`, `GET/POST /api/lists/{id}/ops` (Pull `?since=`, Push idempotent).
-5. Suggestions: `item_names`-Trigger + `GET /api/suggestions?q=`.
+Phase D – Android-Fundament (offen):
+1. Gradle-Setup: Kotlin DSL + `libs.versions.toml`, Hilt/KSP, Compose BOM, Room, Retrofit.
+2. Theme (Material 3) + Navigation (Compose Nav).
+3. Room-Datenbankschema (Listen/Items/OpLog/Outbox).
+4. Retrofit-API + DTOs passend zu den Backend-Endpoints.
 
 ---
 
@@ -216,6 +238,6 @@ docker run --rm --network <net> \
 
 ## Git-Status
 - Repo initialisiert, Branch `main`. Remote ist konfiguriert (`origin`).
-- Phase A + Phase B (1/2: Password/Sessions) committed und gepusht.
-- Phase B (2/2: OIDC) committed und gepusht. **Phase B vollständig ✅.**
-- Nächster Schritt: **Phase C – Sync-Kern** (siehe Roadmap oben).
+- Phase A + Phase B (vollständig) committed und gepusht.
+- Phase C (Sync-Kern + Caddy behind-proxy) committed und gepusht. **Phase C vollständig ✅.**
+- Nächster Schritt: **Phase D – Android-Fundament** (siehe Roadmap oben).