feat(wiki): reader access to home page for wiki-anwender (#0048/#0049)

The Betrieb/Anwender content structure is created (lives in git-storage, not the
job). Add a page rule so wiki-anwender can read the home page besides /anwender —
otherwise "/" would be denied for them. betrieb/* still matches no rule, so
Wiki.js' default-deny keeps it invisible to users (verified in checkAccess:
returns match && !deny). rule() gains a match param for the EXACT home rule.

apps/production/wikijs-config.py

@@ -270,8 +270,8 @@ def ensure_group(jwt: str, name: str, perms: list, rules: list):
     log(f"Gruppe '{name}' -> Rechte+Seitenregeln gesetzt")
 
 
-def rule(rid: str, deny: bool, perms: list, path: str):
-    return {"id": rid, "deny": deny, "match": "START", "roles": perms,
+def rule(rid: str, deny: bool, perms: list, path: str, match: str = "START"):
+    return {"id": rid, "deny": deny, "match": match, "roles": perms,
             "path": path, "locales": []}
 
 
@@ -288,7 +288,12 @@ def main():
     # Erst Gruppen (Schreibvorgänge), DANN OIDC — ensure_oidc deaktiviert zuletzt local.
     # authentik Admins: alles lesen+schreiben. wiki-anwender: nur /anwender lesen.
     ensure_group(jwt, "authentik Admins", ADMIN_PERMS, [rule("adm", False, ["read:pages", "write:pages", "manage:pages"], "")])
-    ensure_group(jwt, "wiki-anwender", READER_PERMS, [rule("anw", False, READER_PERMS, "anwender")])
+    # wiki-anwender: nur den Anwender-Bereich lesen + die Startseite (sonst wäre "/"
+    # für sie gesperrt). betrieb/* matcht keine Regel -> Default-Deny (Abschottung).
+    ensure_group(jwt, "wiki-anwender", READER_PERMS, [
+        rule("anw", False, READER_PERMS, "anwender"),
+        rule("anwhome", False, READER_PERMS, "home", match="EXACT"),
+    ])
     # Guests (id 2) alle Rechte entziehen — Login-Pflicht, keine öffentliche Sicht.
     gql('mutation{groups{update(id:2,name:"Guests",redirectOnLogin:"/",permissions:[],pageRules:[]){responseResult{succeeded}}}}', jwt)
     ensure_oidc(jwt)