Portfolio sync runs on the Cleura server (systemd timer every 20 min) instead of n8n -> Nurem

deploy/cleura/portfolio-sync.sh: same steps as /opt/immich-sync/run-sync.sh on Nurem (fetch main, portfolio-sync.mjs,
commit + push when photos changed) and then build-live.sh main on Cleura; flock against overlapping runs, the sync
runs in the pinned Node container. install-portfolio-sync.sh puts it in place; secrets stay in
/etc/portal/portfolio-sync.env (root 600). The snippet comment no longer mentions the removed /download/original.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/caddy-site.snippet

@@ -10,8 +10,8 @@
 #       import ibo_www_redirect
 #   }
 #   imagesbyolofsson.se {
-#       # Befintliga specialregler (t.ex. handle /download/original* -> Immich-proxyn)
-#       # ska ligga FÖRE importen, så att de vinner över try_files/file_server.
+#       # Specialregler (på Cleura: handle för /about, /contact, /posters -> kundportalen,
+#       # se kundportalens deploy/cleura/caddy/Caddyfile) ska ligga FÖRE importen.
 #       import ibo_site /srv/imagesbyolofsson/dist
 #   }
 #