fix: keep default pdf assets outside runtime media

CONTRIBUTING.md

@@ -44,7 +44,7 @@ Important repository areas:
 - `backend/workflows/`: application code
 - `backend/workflows/templates/workflows/`: templates and in-app documentation
 - `backend/workflows/static/workflows/`: CSS and JS
-- `backend/media/templates/`: PDF HTML templates
+- `backend/workflows/pdf_assets/`: default PDF HTML templates and default letterhead
 
 Current backend modularization:
 - `views.py`: thin route wrapper layer

backend/config/settings.py

@@ -183,8 +183,7 @@ NEXTCLOUD_ENABLED = os.getenv('NEXTCLOUD_ENABLED', '0') == '1'
 
 PDF_OUTPUT_DIR = Path(os.getenv('PDF_OUTPUT_DIR', str(MEDIA_ROOT / 'pdfs')))
 PDF_OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
-PDF_TEMPLATES_DIR = MEDIA_ROOT / 'templates'
-PDF_TEMPLATES_DIR.mkdir(parents=True, exist_ok=True)
+PDF_TEMPLATES_DIR = Path(os.getenv('PDF_TEMPLATES_DIR', str(BASE_DIR / 'workflows' / 'pdf_assets')))
 EMAIL_TEXT_DIR = MEDIA_ROOT / 'email_text'
 EMAIL_TEXT_DIR.mkdir(parents=True, exist_ok=True)
 BACKUP_OUTPUT_DIR = BASE_DIR / 'backups'

backend/workflows/templates/workflows/developer_handbook.html

@@ -64,7 +64,7 @@
       <li><code>/backend/workflows/templates/workflows/base_shell.html</code>: standard page shell for new staff-facing pages</li>
       <li><code>/backend/workflows/roles.py</code>: centralized role names, capability matrix, and template permission helpers</li>
       <li>Rule: all interactive app pages should extend <code>base_shell.html</code>; do not rebuild topbar/frame logic in page-local templates.</li>
-      <li><code>/backend/media/templates/</code>: PDF HTML templates and letterhead source files</li>
+      <li><code>/backend/workflows/pdf_assets/</code>: default PDF HTML templates and default letterhead</li>
       <li><code>/backend/media/pdfs/</code>: generated PDF outputs on host volume</li>
       <li><code>/backend/locale/</code>: translation catalogs</li>
       <li><code>/docker-compose.yml</code>: local runtime orchestration</li>

backend/workflows/templates/workflows/project_wiki.html

@@ -119,9 +119,9 @@
 
     <h2 id="pdfs">7) PDF Engine</h2>
     <ul>
-      <li>Template source: <code>/backend/media/templates/onboarding_template.html</code> and <code>offboarding_template.html</code>.</li>
-      <li>Additional onboarding intro template: <code>/backend/media/templates/onboarding_intro_template.html</code>.</li>
-      <li>Letterhead defaults to <code>/backend/media/templates/templates.pdf</code>, but can be overridden from Admin Apps → <code>Branding</code>.</li>
+      <li>Template source: <code>/backend/workflows/pdf_assets/onboarding_template.html</code> and <code>offboarding_template.html</code>.</li>
+      <li>Additional onboarding intro template: <code>/backend/workflows/pdf_assets/onboarding_intro_template.html</code>.</li>
+      <li>Letterhead defaults to <code>/backend/workflows/pdf_assets/templates.pdf</code>, but can be overridden from Admin Apps → <code>Branding</code>.</li>
       <li>Output folder: <code>/backend/media/pdfs/</code>.</li>
       <li>Fixed PDF labels and notes are rendered through task-level DE/EN text maps and follow the request language with German fallback.</li>
       <li>Signature images are embedded for compatibility with xhtml2pdf rendering.</li>
@@ -190,7 +190,7 @@
       <li><strong>Einweisungs- und Übergabeprotokoll:</strong> staff-only <code>PDF erzeugen</code>, <code>Neu erzeugen</code>, and <code>PDF öffnen</code> actions directly on onboarding rows in the Requests Dashboard.</li>
       <li><strong>Einweisung durchführen:</strong> staff-only live checklist page opened from onboarding rows, with draft/completed status, notes, progress tracking, and a separate live-status PDF export.</li>
       <li><strong>Project Wiki:</strong> this documentation page.</li>
-      <li><strong>UI Shell Standard:</strong> interactive app pages should extend <code>base_shell.html</code>; PDF templates under <code>backend/media/templates/</code> must stay separate.</li>
+      <li><strong>UI Shell Standard:</strong> interactive app pages should extend <code>base_shell.html</code>; default PDF templates under <code>backend/workflows/pdf_assets/</code> must stay separate from runtime media.</li>
       <li><strong>Release Checklist:</strong> dedicated staff-only release runbook for validation, rollout evidence, and rollback basics.</li>
     </ul>