Add phase 1: Docker setup, auth with invitations and roles

- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes,
  healthcheck on /healthz, test profile running pytest against Postgres)
- Custom e-mail user model with user/admin roles
- Invitation-only registration with single-use, hashed, expiring links
- Admin area: invitations, role changes, deactivation, password reset
  via one-time link or temporary password (forced change on login)
- First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup
- Login rate limiting per e-mail and IP (DB-backed, worker-safe)
- Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES,
  optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP)
- Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies
- Mobile-first German UI, CLAUDE.md, README, init-env script
- 65 tests for auth, permissions, proxy handling and rate limiting

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/init-env.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# Creates .env from .env.example with freshly generated secrets.
+# Usage: ./scripts/init-env.sh [admin-email]
+set -e
+cd "$(dirname "$0")/.."
+
+if [ -f .env ]; then
+    echo ".env existiert bereits – nichts geändert." >&2
+    exit 1
+fi
+
+rand() { head -c "$1" /dev/urandom | base64 | tr -d '\n/+=' ; }
+
+secret_key=$(rand 48)
+db_password=$(rand 32)
+admin_password=$(rand 18)
+admin_email=${1:-}
+
+sed -e "s|^SECRET_KEY=.*|SECRET_KEY=${secret_key}|" \
+    -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${db_password}|" \
+    -e "s|^ADMIN_EMAIL=.*|ADMIN_EMAIL=${admin_email}|" \
+    -e "s|^ADMIN_PASSWORD=.*|ADMIN_PASSWORD=${admin_password}|" \
+    .env.example > .env
+chmod 600 .env
+
+echo ".env angelegt. Bitte APP_BASE_URL prüfen."
+if [ -n "$admin_email" ]; then
+    echo "Admin: ${admin_email} / Passwort: ${admin_password}"
+    echo "Nach dem ersten Start kann ADMIN_PASSWORD aus .env entfernt werden."
+else
+    echo "Hinweis: ADMIN_EMAIL ist leer – trage sie in .env ein, bevor du startest."
+fi