fix: Gitea Traefik routing and connection pool optimization

- Remove middleware reference from Gitea Traefik labels (caused routing issues)
- Optimize Gitea connection pool settings (MAX_IDLE_CONNS=30, authentication_timeout=180s)
- Add explicit service reference in Traefik labels
- Fix intermittent 504 timeouts by improving PostgreSQL connection handling

Fixes Gitea unreachability via git.michaelschiemer.de

scripts/maintenance/generate-vapid-keys.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/vendor/autoload.php';
+
+use App\Framework\WebPush\Services\VapidKeyGenerator;
+
+echo "=== VAPID Key Generation for Web Push ===\n\n";
+
+try {
+    $generator = new VapidKeyGenerator();
+    $keyPair = $generator->generate();
+
+    echo "✅ VAPID keys generated successfully!\n\n";
+
+    echo "--- Copy these to your .env file ---\n\n";
+    echo "VAPID_PUBLIC_KEY={$keyPair->publicKey}\n";
+    echo "VAPID_PRIVATE_KEY={$keyPair->privateKey}\n";
+    echo "VAPID_SUBJECT=mailto:admin@example.com\n\n";
+
+    echo "--- Security Notes ---\n";
+    echo "• The PUBLIC key goes in your frontend JavaScript\n";
+    echo "• The PRIVATE key must remain secret on your server\n";
+    echo "• NEVER commit private keys to version control\n\n";
+
+} catch (\Exception $e) {
+    echo "❌ Failed to generate VAPID keys: {$e->getMessage()}\n";
+    exit(1);
+}