feat: Woodpecker-Plugin bump (#2)

## Was

- `woodpecker/bump/`: Plugin, das aus Branch und Commit den nächsten Tag ableitet und setzt (dev, beta, hotfix→beta, main mit und ohne Marker, `release_line`), siehe D8 in oumta-deploy.
- `.woodpecker/plugins.yaml` baut jetzt beide Plugins mit Pfadfilter je Plugin; Release über Tag `bump-vX.Y.Z` bzw. `deploy-vX.Y.Z`.
- Nachträge zum deploy-Plugin aus #1: `plugin-docker-buildx:6` exakt wie in `WOODPECKER_PLUGINS_PRIVILEGED` (war nach dem Merge noch `6.1.2`), Registry-Login mit `oumta-ci` und Secret `oumta_ci_token` statt der globalen Secrets, README-Beispiele entsprechend (zugaenge.md in oumta-deploy).

## Voraussetzungen vor dem Tag

- Secret `oumta_ci_token` in Woodpecker für `actions/ci-cd`, freigegeben für `woodpeckerci/plugin-docker-buildx:6`, Events `push`, `tag`, `manual`.
- `oumta-ci` mit Paket-Schreibrecht in der Org `actions`.

## Getestet

Lokal gegen ein Bare-Repo: dev, beta, hotfix→beta, main mit und ohne Marker, `release_line`, weitergelaufener Branch, fehlendes Token.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #2

README.md

@@ -129,8 +129,8 @@ Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16
 Settings:
 
 - `var` (required): variable in `envs/<env>/images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`).
-- `deploy_token` (required): token of `oumta-ci`, write access to oumta-deploy only. Limit the secret to this image and the events `tag` and `manual`.
-- `registry_username`, `registry_password`: read access to the registry for the digest
+- `deploy_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to oumta-deploy
+- `registry_username`, `registry_password`: read access to the registry for the digest (`oumta-ci` with the same token)
 - `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo)
 - `tag`: default `CI_COMMIT_TAG`
 - `registry`: default `git.uesome.de`
@@ -147,24 +147,56 @@ when:
 
 steps:
   - name: build
-    image: woodpeckerci/plugin-docker-buildx:6.1.2
+    image: woodpeckerci/plugin-docker-buildx:6
     settings:
       registry: git.uesome.de
       repo: git.uesome.de/tanztee/oumta-auth
       tags: ${CI_COMMIT_TAG}
-      username:
-        from_secret: registry_username
+      username: oumta-ci
       password:
-        from_secret: registry_password
+        from_secret: oumta_ci_token
 
   - name: deploy
     image: git.uesome.de/actions/ci-cd/deploy:v1.0.0
     settings:
       var: AUTH_IMAGE
-      registry_username:
-        from_secret: registry_username
+      registry_username: oumta-ci
       registry_password:
-        from_secret: registry_password
+        from_secret: oumta_ci_token
       deploy_token:
-        from_secret: oumta_deploy_token
+        from_secret: oumta_ci_token
+```
+
+### bump
+
+Sets the version for the pushed branch in `package.json`, commits it as `update version: vX [skip ci]`, tags it and pushes branch and tag. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
+
+- `main`: release from the commit message (`release/x.y[.z]`, `hotfix/x.y.z`), otherwise a patch bump
+- `release/*`, `hotfix/*`: next `vX.Y.Z-beta.N`
+- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the release line comes from `release_line`, the newest ancestor `release/*` branch, or `package.json`
+
+Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over.
+
+Settings:
+
+- `git_token` (required): token with write access to the repo (`oumta_ci_token`)
+- `git_user`: default `oumta-ci`
+- `release_line`: optional, `<major>.<minor>[.<patch>]`
+- `author_name`, `author_email`: default `oumta-ci`, `oumta-ci@noreply.git.uesome.de`
+- `remote`: default `CI_REPO_CLONE_URL`
+
+Example:
+
+```yaml
+when:
+  - event: push
+    branch: [develop, 'feature/**', 'release/**', 'hotfix/**']
+  - event: manual
+
+steps:
+  - name: bump
+    image: git.uesome.de/actions/ci-cd/bump:v1.0.0
+    settings:
+      git_token:
+        from_secret: oumta_ci_token
 ```