docs: SparkyFitness (v0.17.2) — CHANGELOG + README rows + REPORT

Live-validated on guest 9201 / controller v0.87.0: synced, deployed via the
real dashboard flow, all 3 containers healthy, /api/health UP through the public
edge. Records §1.3 image-probe findings and the deferred interactive-login item.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2026-06-28 — Add SparkyFitness (v0.17.2) — nutrition/workout tracker
+- New app `templates/sparkyfitness/{docker-compose.yml,.felhom.yml}`: a self-hosted nutrition/calorie +
+  workout/weight tracker (alternative to wger). Three containers — nginx **frontend** (SPA :80, the sole
+  Traefik ingress, proxies `/api`+`/uploads` internally) + Node **server** (:3010) + dedicated
+  **postgres:15-alpine**. Server + DB stay on the internal network with no Traefik labels.
+- **Native email/password auth** (no OIDC/Authentik — that's DooPlex-specific); subdomain `sparky`
+  (deliberately ≠ wger's `fitness` to avoid a Host() collision). `pi_compatible: false`, `needs_hdd: false`.
+- **Two DB roles**: `sparky` (POSTGRES superuser, runs init/migrations) + `sparkyapp` (limited app role the
+  server auto-creates on first boot) — separate `DB_PASSWORD`/`APP_DB_PASSWORD`. `PGDATA` in a `pgdata`
+  subdir of the named volume. Four auto-generated, `locked_after_deploy` secrets; `API_ENCRYPTION_KEY` +
+  `BETTER_AUTH_SECRET` carry `data_key: true` (restore recovers, never regenerates — both are 64-char hex).
+- Transcribed from the validated k3s manifest `homelab-manifests/workout-system/sparkyfitness.yaml`
+  (pinned image tags, two-DB-role model, never-change crypto keys, `/api/health`, pg15 + PGDATA subdir).
+- **Image-probe findings (build server, v0.17.2):** server keeps the `node -e` `/api/health` probe (node
+  present); frontend keeps the `wget --spider` probe (both `wget` and `curl` present). No probe changes needed.
+- **Live-validated on guest 9201 (controller v0.87.0):** synced via "Sablonok frissítése"; deployed through
+  the real dashboard flow (Domain auto, Subdomain `sparky`, 4 secrets auto-gen). All 3 containers healthy;
+  server log shows clean migrations + `sparkyapp` role created + RLS applied, no crash loop, no uploads
+  EACCES; `GET /api/health` through the public edge returns `{"status":"UP"}`; login/register page serves
+  over a valid TLS cert at `https://sparky.demo-felhom.eu`.
+
 ## 2026-06-26 — crafty-controller: image bump 4.4.8→4.10.7 + publish Java port range + connection guidance
 - **Image bump** `crafty-4:4.4.8` → `4.10.7` (latest stable; 4.10.8/4.11.0 don't exist in the registry).
   6 minor versions of fixes incl. security CVEs. **Java 25 verified present** in 4.10.7