Merge branch 'feat/footer-share-ci' into dev

CI keeps the 'test once per code state' plan but records commit and
git tree as image labels instead of extra :sha-/:tree- tags, so the
registry only holds dev, latest, vX.Y.Z and stable; the plan test now
asserts the expected decisions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -99,8 +99,9 @@ func (s SpeechConfig) Mode(demo bool) string {
 }
 
 type LegalTexts struct {
-	ImprintURL, ImprintContent string
-	PrivacyURL, PrivacyContent string
+	ImprintURL, ImprintContent     string
+	PrivacyURL, PrivacyContent     string
+	CustomLinkLabel, CustomLinkURL string
 }
 
 // Publicly known JWT secrets (old code default and the placeholders from .env.example, compose and
@@ -176,6 +177,20 @@ func legalURL(name string) string {
 	return v
 }
 
+// legalCustomLink accepts only https links for the custom footer link.
+func legalCustomLink(labelVar, urlVar string) (string, string) {
+	u := strings.TrimSpace(os.Getenv(urlVar))
+	if u == "" {
+		return "", ""
+	}
+	if !strings.HasPrefix(u, "https://") {
+		slog.Warn("Custom-Link-URL ignoriert: nur https erlaubt", "variable", urlVar, "url", u)
+		return "", ""
+	}
+	label := strings.TrimSpace(os.Getenv(labelVar))
+	return label, u
+}
+
 func Load() *Config {
 	port := getEnv("PORT", "8080")
 	dataDir := getEnv("DATA_DIR", "./data")
@@ -255,12 +270,17 @@ func Load() *Config {
 			QuotaMB:    envInt("MEDIA_QUOTA_MB", 0, 0, 10000000),
 			DemoMaxMB:  envInt("MEDIA_DEMO_MAX_MB", 3, 1, 100),
 		},
-		Legal: LegalTexts{
-			ImprintURL:     legalURL("LEGAL_IMPRINT_URL"),
-			ImprintContent: legalContent("LEGAL_IMPRINT_CONTENT"),
-			PrivacyURL:     legalURL("LEGAL_PRIVACY_URL"),
-			PrivacyContent: legalContent("LEGAL_PRIVACY_CONTENT"),
-		},
+		Legal: func() LegalTexts {
+			customLabel, customURL := legalCustomLink("LEGAL_CUSTOM_LINK_LABEL", "LEGAL_CUSTOM_LINK_URL")
+			return LegalTexts{
+				ImprintURL:      legalURL("LEGAL_IMPRINT_URL"),
+				ImprintContent:  legalContent("LEGAL_IMPRINT_CONTENT"),
+				PrivacyURL:      legalURL("LEGAL_PRIVACY_URL"),
+				PrivacyContent:  legalContent("LEGAL_PRIVACY_CONTENT"),
+				CustomLinkLabel: customLabel,
+				CustomLinkURL:   customURL,
+			}
+		}(),
 	}
 }