Initial commit: Arbeitsorte-Logger + data-safety/robustness/input work

Existing app (single-file Tkinter/ttkbootstrap desktop tool for logging
blood-drive work assignments and mapping them) plus the first round of
improvements:

- Data safety: atomic CSV writes (tmp + fsync + os.replace), rotating
  backups in data/backups/ (startup + before every change, keep 20),
  fallback to empty/backup on missing/empty/corrupt orte.csv.
- Geocoder robustness: per-item try/except so the worker thread survives
  failures; GeocodingUnavailable + one-time "service unreachable" dialog.
- Input: DateEntry calendar picker with parse_date() validation; manual
  lat/lon fields in the edit dialog; Tab 2 highlights/filters rows without
  coordinates and adds a right-click "Koordinaten suchen".
- Logging to data/app.log; shared autocomplete helpers; config constants;
  map fit_bounds.

docs/ describes current state, architecture, data model, setup (Linux Mint),
and the full improvement roadmap. data/orte.csv is gitignored for now.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/changelog.md

@@ -0,0 +1,47 @@
+# Changelog
+
+Notable changes to the app. Newest first.
+
+## 2026-09-07 — data safety, robustness, easier input
+
+Addressed the top three findings from [improvements.md](improvements.md).
+
+### Data safety (`DataStore`)
+- All writes (append / update / delete) now rebuild the full DataFrame and go
+  through `_save_csv`: **rotating backup** to `data/backups/` (startup + before
+  every change, keep 20, skip if unchanged) then **atomic write**
+  (`tmp` + `fsync` + `os.replace`).
+- `orte.csv` missing / empty (`EmptyDataError`) / unreadable now falls back to an
+  empty table or the newest backup instead of crashing.
+
+### Geocoder robustness (`GeocoderWorker`, `geocode_city`)
+- Each queue item runs inside `try/except`; a failing lookup or callback logs a
+  traceback and the worker keeps going (previously an unexpected error killed the
+  thread and silently froze all further geocoding).
+- `geocode_city` raises `GeocodingUnavailable` when every query failed on a
+  service/network error. After 3 in a row the app shows a one-time
+  "Standortdienst nicht erreichbar" dialog; entries still save without
+  coordinates.
+
+### Easier, safer input
+- Date fields (entry form + edit dialog) are now `ttkbootstrap.DateEntry`
+  calendar pickers, validated/normalized to ISO by `parse_date()` (also accepts
+  `TT.MM.JJJJ`). Invalid dates are rejected with a dialog.
+- Edit dialog has manual **Breitengrad / Längengrad** fields for fixing
+  coordinates by hand.
+- Tab 2: rows without coordinates shown in red, "Nur ohne Koordinaten" filter,
+  count in the hint line, right-click **Koordinaten suchen**.
+
+### Housekeeping
+- `git init` + `.gitignore`.
+- Rotating log file at `data/app.log` (`_setup_logging`).
+- Shared helpers `filter_locations` / `split_city_plz` / `parse_coord` replace
+  duplicated combobox code.
+- Config constants: `GEOCODE_REGIONS`, `MAP_DEFAULT_CENTER`, `MAP_DEFAULT_ZOOM`,
+  `MAX_BACKUPS`.
+- `generate_map` fits the view to the markers.
+
+### Verification
+Non-GUI smoke tests (helpers, `DataStore` backup/atomic/recovery, geocoder
+resilience) pass. **The GUI could not be run on the development Mac** — see
+[dev-notes.md](dev-notes.md).