Add phase 1: Docker setup, auth with invitations and roles

- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes,
  healthcheck on /healthz, test profile running pytest against Postgres)
- Custom e-mail user model with user/admin roles
- Invitation-only registration with single-use, hashed, expiring links
- Admin area: invitations, role changes, deactivation, password reset
  via one-time link or temporary password (forced change on login)
- First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup
- Login rate limiting per e-mail and IP (DB-backed, worker-safe)
- Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES,
  optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP)
- Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies
- Mobile-first German UI, CLAUDE.md, README, init-env script
- 65 tests for auth, permissions, proxy handling and rate limiting

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/dev_server.py

@@ -0,0 +1,24 @@
+"""Local development server without Docker (SQLite, plain HTTP). Not for production."""
+
+import os
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+os.chdir(ROOT)
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
+os.environ.setdefault("DEBUG", "true")
+os.environ.setdefault("SECRET_KEY", "dev-only-secret-key")
+os.environ.setdefault("APP_BASE_URL", "http://localhost:8000")
+os.environ.setdefault("COOKIE_SECURE", "false")
+os.environ.setdefault("ADMIN_EMAIL", "[email protected]")
+os.environ.setdefault("ADMIN_PASSWORD", "Dev-Admin-Passwort-1")
+os.environ.setdefault("ADMIN_NAME", "Dev-Admin")
+
+from django.core.management import execute_from_command_line  # noqa: E402
+
+execute_from_command_line(["manage.py", "migrate", "--noinput"])
+execute_from_command_line(["manage.py", "ensure_admin"])
+execute_from_command_line(["manage.py", "runserver", "127.0.0.1:8000", "--noreload"])

scripts/init-env.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# Creates .env from .env.example with freshly generated secrets.
+# Usage: ./scripts/init-env.sh [admin-email]
+set -e
+cd "$(dirname "$0")/.."
+
+if [ -f .env ]; then
+    echo ".env existiert bereits – nichts geändert." >&2
+    exit 1
+fi
+
+rand() { head -c "$1" /dev/urandom | base64 | tr -d '\n/+=' ; }
+
+secret_key=$(rand 48)
+db_password=$(rand 32)
+admin_password=$(rand 18)
+admin_email=${1:-}
+
+sed -e "s|^SECRET_KEY=.*|SECRET_KEY=${secret_key}|" \
+    -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${db_password}|" \
+    -e "s|^ADMIN_EMAIL=.*|ADMIN_EMAIL=${admin_email}|" \
+    -e "s|^ADMIN_PASSWORD=.*|ADMIN_PASSWORD=${admin_password}|" \
+    .env.example > .env
+chmod 600 .env
+
+echo ".env angelegt. Bitte APP_BASE_URL prüfen."
+if [ -n "$admin_email" ]; then
+    echo "Admin: ${admin_email} / Passwort: ${admin_password}"
+    echo "Nach dem ersten Start kann ADMIN_PASSWORD aus .env entfernt werden."
+else
+    echo "Hinweis: ADMIN_EMAIL ist leer – trage sie in .env ein, bevor du startest."
+fi