v0.2.3 — Clearer setup and safe failure diagnostics

Patch release for clearer setup and safe failure diagnosis.

• Refresh the README with a visual overview, navigation and a complete Docker Compose setup guide.
• Clarify vault-only broker credentials, mapping currencies, container UID and filesystem permissions, optional date-window arguments and fresh rolling verification.
• Report allowlisted failure stages and reasons for configuration, vault operations, broker access, Ghostfolio reads and reconciliation. Diagnostics do not include credentials, request/response bodies or raw exception messages.
• Keep malformed command arguments private while preserving exit codes (2 for malformed arguments, 1 for operational failures).

Source: PR #50, merged as 6bdd0be94de1183dddbfe90bea5e2c6c547f1cdf. The reviewed head passed 1,527 offline tests, including 52 diagnostics/privacy scenarios, core integrity and native amd64/arm64 container checks. Completed CodeRabbit coverage applies to the exact reviewed head.

Image publication and public artifact verification are complete. Release workflow passed offline tests, dependency/security checks, native amd64/arm64 smoke and synthetic community acceptance. Both architectures include SBOM and provenance.

Use DEGIRO_IMAGE=ghcr.io/flowcool/ghostfolio-degiro-sync:v0.2.3 in the documented Compose configuration. Preserve mapping and state, keep DRY_RUN=1, and record the current image digest before any operator-controlled upgrade. Rollback uses the previous immutable image digest with the same persistent state. This patch does not change financial policy or authorize deployment or financial writes.

Published image: ghcr.io/flowcool/ghostfolio-degiro-sync:v0.2.3 (linux/amd64 and linux/arm64).

Immutable digest: sha256:bd1e548aec4c1fca2dcd7a8b2ea40a8c45f8ef4b82e80dc82a4849669b8e3e75. Stable latest resolves to the same digest. The anonymously fetched manifest matches the CI manifest.

The exact published digest passed anonymous Compose pull and the complete synthetic community journey from a clean clone of this release, with runtime networking disabled. Scheduled DRY_RUN failure delivered one notification through the real Apprise library with mocked HTTP; success remained silent. Switching to the previous v0.2.2 image and restoring this digest preserved synthetic mapping, state and journal hashes. Public manifest, architecture digests and verification evidence are attached. No production deployment or financial mutation was performed.