Stop pretending Vercel is an option

It was never used. The repository lives on a self-hosted Gitea, which
Vercel's git integration cannot connect to at all — so the documented
route amounted to "mirror to GitHub first", and nobody did.

vercel.json is gone, and with it the branch in next.config.ts that
switched off `output: "standalone"` when the VERCEL variable was
present. That branch was the only functional trace; everything else was
documentation and comments describing a second deployment path that did
not exist.

DEPLOYMENT.md loses its "two supported ways" framing and the whole
Vercel section — about fifty lines. Several statements next to it were
stale for a different reason and are corrected in the same pass: the
outbound-firewall table still listed Supabase's pooler (the database is
a container now, nothing leaves the server), the prerequisites still
demanded an existing Supabase project, and the .env table still asked
for a pooler connection string instead of the two new passwords.

The nightly job is described as what it is — a container in
docker-compose.yml — rather than as a replacement for Vercel Cron.

Migrations keep their references: two comments from July mention Vercel
Cron, and they describe what was true when they were written.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/(app)/audit/page.tsx

@@ -21,8 +21,8 @@ function pageHref(params: SearchParams, page: number): string {
 }
 
 // Pinned to Vienna and built once: audit_log.occurred_at is a timestamptz, and
-// an unpinned formatter renders it in the *server's* zone — UTC in Docker and
-// on Vercel — so every entry would read an hour or two early for the people
+// an unpinned formatter renders it in the *server's* zone — UTC in the
+// container — so every entry would read an hour or two early for the people
 // the log is for.
 const dateTimeFormatter = new Intl.DateTimeFormat("de-AT", {
   day: "2-digit",

app/api/cron/apply-pending-changes/route.ts

@@ -4,10 +4,11 @@ import { callFunction } from "@/lib/db/rpc";
 
 // Applies effective-dated changes (Versetzung/Beförderung/Karenz/Reorg/Daten
 // ändern with a future "Wirksam ab" date) once their date has arrived — see
-// apply_due_pending_changes() in supabase/migrations. Runs as a Vercel Cron
-// job (see vercel.json), not on behalf of any HR user, so it authenticates
-// via a shared secret rather than a Supabase session and uses the
-// service-role client (the one legitimate server-only use case for it).
+// apply_due_pending_changes() in supabase/migrations.
+//
+// Gerufen wird das vom `cron`-Dienst aus docker-compose.yml, täglich um 03:00.
+// Nicht im Namen einer HR-Person: es gibt keine angemeldete Sitzung, deshalb
+// weist sich der Aufruf mit einem gemeinsamen Geheimnis aus (CRON_SECRET).
 export async function GET(request: NextRequest) {
   const authHeader = request.headers.get("authorization");
   if (!process.env.CRON_SECRET || authHeader !== `Bearer ${process.env.CRON_SECRET}`) {

app/api/import/route.ts

@@ -25,10 +25,10 @@ class Rueckabwicklung extends Error {
   }
 }
 
-// 60 Sekunden, weil das die Obergrenze im kostenlosen Vercel-Tarif ist —
-// ein höherer Wert lässt sich dort nicht ausrollen. Auf einem eigenen Server
-// gilt die Angabe ohnehin nicht, und im Pro-Tarif liesse sie sich auf 300
-// heben, falls eine Datei mit vielen tausend Zeilen ansteht.
+// Im eigenen Container wirkt diese Angabe nicht — sie richtet sich an
+// serverlose Plattformen, die einen Aufruf nach Ablauf abschneiden. Sie bleibt
+// als Absichtserklärung stehen: ein Import, der länger als eine Minute
+// braucht, ist einer, der in Teilen laufen sollte.
 export const maxDuration = 60;
 
 type Antwort = {