feat: standalone libreshop demo stack pinned to v0.1.0

White-label preview: brings up cms + cms-db + mail + pdf + nginx +
shop with placeholder env so the toolkit runs clickably without
any adapter. Adapters (e.g. mp) replace compose.yaml with their own
composition + branding env.

Every libreshop component image is pinned to :v0.1.0 — override per
service via LIBRESHOP_<SVC>_TAG in .env if testing rolling :main.
.env.example documents every variable; mail stays in stdout-log
mode and PayPal stays in sandbox/no-creds mode by default.

README.md

@@ -0,0 +1,80 @@
+# libreshop/demo
+
+Standalone preview of the [libreshop](https://git.librete.ch/libreshop)
+toolkit. Composes `cms`, `mail`, `pdf`, `nginx`, `shop` (plus a
+Postgres for the CMS) with placeholder env so the stack runs
+clickably without any adapter.
+
+This is the white-label preview — no muellerprints branding, no
+specific product catalogue, no production credentials. Adapters
+(e.g. [`mp`](https://git.librete.ch/libretech/mp)) replace the
+`compose.yaml` here with their own composition + branding env.
+
+## Quick start
+
+```sh
+git clone https://git.librete.ch/libreshop/demo
+cd demo
+cp .env.example .env
+docker compose pull
+docker compose up -d
+```
+
+Open [http://localhost:8080](http://localhost:8080) — nginx fronts
+the Nuxt shop on `:9999` and proxies `/api/*` to Strapi on `:5555`.
+
+Strapi admin: log into the CMS at
+`http://localhost:8080/admin` and create the first admin user on
+first launch.
+
+## What is and isn't in the demo
+
+In:
+
+- All five libreshop component images, pinned to `:v0.1.0`.
+- Postgres for the CMS (`postgres:16-alpine`).
+- Inter-service networking via the `internal` and `data` docker
+  networks.
+- Healthchecks per service.
+
+Out:
+
+- Real SMTP — mail stays in stdout-log mode unless you fill the
+  `MAIL_SMTP_RELAY_*` block in `.env`.
+- Real PayPal — `PAYMENT_ENVIRONMENT=sandbox` with no client ID.
+- TLS — nginx serves plain HTTP on port 8080. Front it with caddy /
+  another reverse proxy + Let's Encrypt for a public deployment.
+- Production data — the CMS starts empty.
+
+## Versions
+
+`.env.example` pins every component to a `:v0.1.0` tag. To test the
+rolling `:main` of one component, override its tag:
+
+```sh
+LIBRESHOP_CMS_TAG=main docker compose up -d cms
+```
+
+Each component publishes `:main`, `:sha-<7>`, `:vX.Y.Z`, and `:latest`
+(latest only on tag pushes). For reproducible runs always pin a
+specific `:vX.Y.Z`.
+
+## Troubleshooting
+
+- **Strapi takes 2-5 min to start on first run** (DB init + admin
+  setup). The `start_period: 5m` healthcheck accommodates this.
+- **`pull access denied`** — the libreshop registry is currently
+  read-public, so anonymous pull works. If you see auth errors on
+  pull, either the package was unpublished or your docker daemon
+  is hitting a stale credential. Try `docker logout git.librete.ch`.
+- **CORS / origin mismatches** — `SHOP_SITE_URL` and `NGINX_HOST` in
+  `.env` must match the URL you actually open in a browser.
+
+## Contributing
+
+The demo composition follows the libreshop adapter contract — env
+overrides + bind-mounted volumes only, no `docker exec` patches into
+running containers. If a new env var is needed for an adapter, raise
+it on the relevant component repo (e.g.
+`git.librete.ch/libreshop/cms/issues`) and the demo will pick it up
+on the next release.