Backend Phase C: Sync-Kern + Caddy behind-proxy

Sync-Kern:
- internal/sync/hlc.go: Hybrid Logical Clock (wall_ms<<16|counter)
  Tick/Now/After, global mutex, strikt monoton + kausal korrekt
- internal/sync/hlc_test.go: Unit-Tests (monoton, kausal, keine Duplikate)

Store-Schicht:
- internal/store/opstore.go: AppendOps idempotent via UNIQUE(client_id,
  client_seq) ON CONFLICT DO NOTHING; LWW-Projektion (list_create/
  rename/delete, item_add/update/remove) in derselben Transaktion;
  PullOps mit Cursor (seq > since, 500er Pages)
- internal/store/liststore.go: CreateList / GetLists / GetList
- internal/store/itemstore.go: GetItems (nicht-gelöschte Items)
- internal/store/suggeststore.go: Search (pg_trgm + LIKE-fallback, 10)

HTTP-Handler:
- internal/httpapi/lists.go: GET/POST /api/lists, GET /api/lists/{id}
- internal/httpapi/ops.go: POST /api/lists/{id}/ops (Push),
  GET /api/lists/{id}/ops (Pull ?since=)
- internal/httpapi/suggest.go: GET /api/suggestions?q=
- internal/httpapi/api.go: alle Routen verdrahtet (RequireAuth)

Deployment:
- deploy/Caddyfile.behind-proxy: auto_https off, trusted_proxies
- deploy/Caddyfile: X-Forwarded-Proto hinzugefügt, Kommentar aktualisiert
- deploy/docker-compose.yml: CADDY_HTTP_PORT + CADDY_HTTPS_PORT
- deploy/.env.example: Caddy-Port-Variablen dokumentiert

go build ./... && go vet ./... && go test ./... ✅
HLC-Tests: monoton, kausal, keine Duplikate ✅
AGENTS.md: Phase C vollständig ✅

deploy/.env.example

@@ -42,3 +42,15 @@ OIDC_GENERIC_CLIENT_ID=             # audience the backend accepts
 # --- CORS (only relevant for browser clients; Android doesn't need it) ---
 # Comma-separated list of allowed origins, e.g. https://app.example.com
 CORS_ALLOWED_ORIGINS=
+
+# --- Caddy ports ---
+# Standalone mode (Caddy handles TLS directly):
+CADDY_HTTP_PORT=80
+CADDY_HTTPS_PORT=443
+
+# Behind a reverse proxy (your proxy does TLS, Caddy is plain HTTP):
+# 1. Change CADDY_HTTP_PORT to the port your proxy forwards to.
+# 2. Mount Caddyfile.behind-proxy instead of Caddyfile in docker-compose.yml.
+# 3. Remove the CADDY_HTTPS_PORT lines from docker-compose caddy.ports.
+#
+# CADDY_HTTP_PORT=8880