Dawarich: the third new app through the checklist — template, record, fixture, first ladder step 1.15.2 -> 1.15.3

Location history with PostGIS 17 + Redis + Sidekiq. The seeded known login replaced by after_install behind the install
hold; geocoding off; SECRET_KEY_BASE a data_key; smtp_mapping with mail-off boot measured. onboarding/dawarich.md complete.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,16 @@
+## Dawarich — the third app through the new-app checklist (2026-10-01, evening)
+
+- **`templates/dawarich/`** — your own location history (instead of Google Timeline): `freikin/dawarich:1.15.3` (web +
+  sidekiq), `postgis/postgis:17-3.5-alpine`, `redis:7.4-alpine` — upstream's own compose, pinned. The image seeds
+  `demo@dawarich.app` / `safepassword`; `after_install` sets the generated password through `bin/rails runner` (ARGV),
+  and the install hold keeps strangers out until then (measured: the first public answer 2 s after). Reverse geocoding
+  off; the page says the browser loads map tiles from Dawarich's tile server. `SECRET_KEY_BASE` is a data_key (encrypted
+  columns). The public login name locks for 1 h after 10 wrong tries — kept as mealie (decision 57); the first step tells
+  the household to set its own e-mail. App-email by `smtp_mapping`; mail OFF boots (measured).
+- First ladder step 1.15.2 -> 1.15.3 proven on the bench (swap 0) and on 9202; remove + restore read the point back and
+  the household's own password still signs in.
+- `onboarding/dawarich.md`, fixture `Dawarich`, FIRST-ADMIN row, README tables, Hungarian freeze.
+
 ## Karakeep — the second app through the new-app checklist (2026-10-01, evening)
 
 - **`templates/karakeep/`** — bookmarks, articles, notes (formerly Hoarder): `ghcr.io/karakeep-app/karakeep:0.33.2` +