Split install for non-admin users

The target laptop account has no sudo. install.sh now runs without root once the
system packages exist; if they're missing and the account can't sudo it prints
the exact command and stops. New install-system.sh holds the one-time
"sudo apt install python3-tk python3-venv git" for an admin account.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/changelog.md

@@ -2,10 +2,20 @@
 
 Notable changes to the app. Newest first.
 
+## 2026-09-07 — install split for non-admin users
+
+The target account has no sudo, so install is two scripts:
+
+- `install-system.sh` – admin runs once: `apt install python3-tk python3-venv git`.
+- `install.sh` – user runs, **no sudo**: checks the system packages, creates
+  `.venv` + installs `requirements.txt`, writes the `.desktop` menu entry. If a
+  package is missing and the account can't sudo, it prints the exact admin
+  command and stops.
+
 ## 2026-09-07 — one-command install + launcher
 
-- `install.sh` – one-time Linux Mint setup: apt packages, `.venv` +
+- `install.sh` – Linux Mint setup: `.venv` + `requirements.txt`, and a
-  `requirements.txt`, and a `.desktop` menu entry with correct absolute paths.
+  `.desktop` menu entry with correct absolute paths.
 - `run.sh` – launches the app from `.venv`; the menu entry calls this.
 - `icon.png` – bundled red-cross launcher/window icon (256×256); the app now
   prefers this over the runtime-drawn one.

docs/setup.md

@@ -3,7 +3,24 @@
 Target machine: **Linux Mint laptop**, single non-technical user. Day-to-day use
 is a **double-click from the menu**; the terminal is needed once, for install.
 
-## Quick install (Linux Mint)
+## Install (Linux Mint)
+
+The target user's account is a **Standard** account (no sudo). Install is
+therefore two steps: one system step by an admin, then the rest by the user.
+
+### Step 1 — system packages (admin account, once)
+
+`python3-tk`, `python3-venv` and `git` are system packages. From an account with
+admin rights (Patrick's):
+
+```bash
+cd /path/to/DRK_Blutspende_Orte
+./install-system.sh          # sudo apt install python3-tk python3-venv git
+```
+
+Skip this if those three are already present.
+
+### Step 2 — the app (user account, no sudo)
 
 ```bash
 mkdir -p ~/Apps && cd ~/Apps
@@ -12,10 +29,11 @@ cd DRK_Blutspende_Orte
 ./install.sh
 ```
 
-`install.sh` does everything:
+`install.sh` needs no sudo once step 1 is done. It:
 
-1. `sudo apt install python3-tk python3-venv python3-pip git` (asks for the
+1. checks the system packages are there (if not, and the account *does* have
-   password),
+   sudo, it installs them; otherwise it prints the exact `install-system.sh`
+   line an admin must run and stops),
 2. creates `.venv` and installs the pinned `requirements.txt`,
 3. writes `~/.local/share/applications/drk-blutspende-orte.desktop` with the
    correct absolute paths and the bundled `icon.png`.
@@ -24,13 +42,19 @@ After it finishes, **"DRK Blutspende – Arbeitsorte"** is in the application me
 (log out/in once if it doesn't show immediately). First manual test: `./run.sh`.
 
 > Clone it — don't download a zip. The in-app updater and `run.sh` both rely on
-> it being a real git checkout.
+> it being a real git checkout. The clone lives in the **user's** home so she can
+> update it without sudo.
+
+If you do both steps yourself in one go: run `./install-system.sh` as admin,
+then `su - <heraccount> -c '~/Apps/DRK_Blutspende_Orte/install.sh'` (or just log
+in as her and run step 2).
 
 ## What the pieces are
 
 | File | Purpose |
 |------|---------|
-| `install.sh` | one-time setup (above). Safe to re-run. |
+| `install-system.sh` | admin, once: `apt install python3-tk python3-venv git`. |
+| `install.sh` | user, no sudo: venv + deps + menu entry. Safe to re-run. |
 | `run.sh` | launches the app from `.venv`; the `.desktop` entry calls this. |
 | `icon.png` | bundled launcher/window icon (red cross). Replace with the real DRK logo if wanted. |
 | `requirements.txt` | fully pinned, tested on Python 3.12. |

install-system.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# EINMALIG von einem Konto mit Administrator-Rechten ausführen (Patrick).
+# Installiert die System-Pakete, die die App braucht – danach kann das
+# normale Benutzerkonto  ./install.sh  ohne sudo ausführen.
+set -euo pipefail
+
+sudo apt update
+sudo apt install -y python3-tk python3-venv git
+
+echo
+echo "System-Pakete installiert. Jetzt als das normale Konto:  ./install.sh"

install.sh

@@ -1,25 +1,47 @@
 #!/usr/bin/env bash
-# Einmalige Einrichtung auf einem Linux-Mint-Rechner:
+# Einrichtung der App – läuft OHNE Administrator-Rechte, solange die
-#   - benötigte System-Pakete
+# System-Pakete (python3-tk, python3-venv, git) schon installiert sind.
-#   - virtuelle Python-Umgebung + Abhängigkeiten
+# Falls nicht: einmalig  ./install-system.sh  von einem Admin-Konto ausführen.
-#   - Eintrag im Startmenü
 #
-# Aufruf:  ./install.sh
+# Aufruf:  ./install.sh          (kann gefahrlos wiederholt werden)
 set -euo pipefail
 cd "$(dirname "$(readlink -f "$0")")"
 APPDIR="$(pwd)"
 
-echo "==> System-Pakete (fragt nach dem Passwort)…"
+# ── 1. System-Voraussetzungen prüfen ────────────────────────────────────────
-sudo apt update
+missing=()
-sudo apt install -y python3-tk python3-venv python3-pip git
+python3 -c 'import tkinter'   2>/dev/null || missing+=("python3-tk")
+python3 -c 'import ensurepip' 2>/dev/null || missing+=("python3-venv")
+command -v git >/dev/null     2>/dev/null || missing+=("git")
 
-echo
+if [ "${#missing[@]}" -gt 0 ]; then
+    if id -nG | tr ' ' '\n' | grep -qxE 'sudo|wheel|admin'; then
+        echo "==> Fehlende System-Pakete werden installiert: ${missing[*]}"
+        sudo apt update
+        sudo apt install -y "${missing[@]}"
+    else
+        cat >&2 <<EOF
+
+Es fehlen System-Pakete, und dieses Konto hat keine Administrator-Rechte:
+  ${missing[*]}
+
+Bitte einmal von einem Admin-Konto (Patrick) ausführen:
+
+  cd "$APPDIR" && ./install-system.sh
+
+Danach dieses Skript hier erneut starten:  ./install.sh
+EOF
+        exit 1
+    fi
+fi
+
+# ── 2. Virtuelle Umgebung + Abhängigkeiten (ohne sudo) ──────────────────────
 echo "==> Virtuelle Umgebung unter .venv …"
 python3 -m venv .venv
-.venv/bin/pip install --upgrade pip
+.venv/bin/python -m pip install --upgrade pip
-.venv/bin/pip install -r requirements.txt
+.venv/bin/python -m pip install -r requirements.txt
 
-echo
+# ── 3. Startmenü-Eintrag (ohne sudo, nur für dieses Konto) ──────────────────
 echo "==> Startmenü-Eintrag …"
 DESKTOP_DIR="$HOME/.local/share/applications"
 mkdir -p "$DESKTOP_DIR"
@@ -40,5 +62,5 @@ update-desktop-database "$DESKTOP_DIR" 2>/dev/null || true
 echo
 echo "Fertig."
 echo "Die App ist jetzt im Menü als \"DRK Blutspende – Arbeitsorte\" zu finden"
-echo "(ggf. einmal ab- und wieder anmelden, damit sie auftaucht)."
+echo "(ggf. einmal ab- und wieder anmelden)."
 echo "Direkt testen:  ./run.sh"