v0.1.0: README komplett auf Deutsch, Status-Block, ehrliche Limit-Liste

- Status-Block: v0.1.0, im Einsatz seit April 2026, 500 Deploys/Woche
- What-works und Known-limitations explizit dokumentiert
- 'Battle-tested' raus, konkrete Einsatz-Zahlen rein
- Roadmap (v0.2/0.3/0.4) angekuendigt
- CHANGELOG.md angelegt

Author: Claude (Netzhandwerker)

CHANGELOG.md

@@ -1,38 +1,27 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
-The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
-This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+Alle nennenswerten Änderungen an diesem Projekt werden hier dokumentiert.
+Format orientiert sich an [Keep a Changelog](https://keepachangelog.com/de/),
+Versionierung nach [SemVer](https://semver.org/lang/de/).
 
-## [Unreleased]
+## [0.1.0] — 2026-05-19
 
-## [1.0.0] — 2026-05-19
+### Hinzugefügt
+- Initialer Public Release
+- Single-File-PHP-Gateway mit Pfad-Traversal-Schutz
+- Endungs-Whitelist
+- Optimistic Locking via `If-Match`-Header (SHA-256)
+- Single-File-Snapshots mit content-adressierter Deduplikation
+- Atomare Batch-Deploys
+- Rate-Limiting (global + per IP), file-basiert
+- Audit-Log (append-only)
+- Binary-Upload-Helfer für Dateien > 800 KB
+- Status-Block, What-works, Known-limitations in README
 
-Initial public release. Extracted and anonymized from a production deployment that has been running on All-Inkl shared hosting since April 2026.
+### Im Einsatz seit
+- April 2026 unter netzhandwerker.de — rund 500 Deploys/Woche
 
-### Added
-- Single-file PHP gateway with `ping`, `read`, `write`, `write_b64`, `list`, `delete`, `snapshot`, `snapshots`, `rollback`, `deploy_batch` actions
-- Path traversal protection (null byte, `..`, `.`, dangerous extension blocklist)
-- Writable extension allowlist (configurable)
-- Optimistic locking via `If-Match: <sha256>` header
-- Single-file snapshots for individual writes (memory-efficient)
-- Full-site snapshots for batch operations
-- Content-addressed object store with automatic deduplication
-- Garbage collection of unreferenced snapshot objects
-- Rate limiting: 30 requests/minute global, 10/minute per IP (file-based, no Redis)
-- Append-only audit log with key fingerprint + IP + path + byte count
-- Python client class with conflict-aware `read → edit → write` pattern
-- Bash deployment example with `--data-urlencode`
-- GitHub Actions workflow for push-to-deploy
-- Companion `bin-upload.php` helper for large binary uploads via `php://input`
-
-### Security
-- Dangerous extensions (`.phar`, `.phtml`, `.php3-7`, `.pht`, `.inc`) explicitly blocked from writes
-- API key never logged in plaintext; only first 8 chars of sha256 fingerprint appear in audit log
-- IP addresses hashed before being used as rate-limit-bucket filenames
-
-### Known limitations
-- Single API key per gateway instance (no multi-tenant support)
-- No built-in 2FA / time-based key rotation
-- Snapshots stored on the same disk as the deploy target (no off-host backup)
-- HTTP only — relies on the host's TLS termination
+### Bekannte Grenzen
+- API-Key hat vollen Schreibzugriff (kein Multi-Tenant)
+- Audit-Log-Rotation manuell
+- Snapshots werden nicht automatisch extern gesichert