Add phase 1: Docker setup, auth with invitations and roles

- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes,
  healthcheck on /healthz, test profile running pytest against Postgres)
- Custom e-mail user model with user/admin roles
- Invitation-only registration with single-use, hashed, expiring links
- Admin area: invitations, role changes, deactivation, password reset
  via one-time link or temporary password (forced change on login)
- First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup
- Login rate limiting per e-mail and IP (DB-backed, worker-safe)
- Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES,
  optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP)
- Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies
- Mobile-first German UI, CLAUDE.md, README, init-env script
- 65 tests for auth, permissions, proxy handling and rate limiting

Co-Authored-By: Claude Opus 5.5 <[email protected]>

templates/accounts/admin/invitations.html

@@ -0,0 +1,35 @@
+{% extends "base.html" %}
+{% block title %}Einladungen{% endblock %}
+{% block content %}
+<h1>Einladungen</h1>
+<form method="post" class="card" novalidate>
+  {% csrf_token %}
+  <h2>Neue Einladung</h2>
+  {% include "form_fields.html" %}
+  <button type="submit" class="button">Einladungslink erzeugen</button>
+</form>
+
+<h2>Bisherige Einladungen</h2>
+{% if invitations %}
+<ul class="list">
+  {% for inv in invitations %}
+  <li class="card">
+    <div class="row-head">
+      <strong>{{ inv.note|default:inv.email|default:"Einladung" }}</strong>
+      <span class="badge{% if inv.status != 'open' %} badge-muted{% endif %}">{{ inv.status_label }}</span>
+      <span class="badge badge-muted">{{ inv.get_role_display }}</span>
+    </div>
+    <div class="muted">
+      {% if inv.email %}{{ inv.email }} · {% endif %}erstellt {{ inv.created_at|date:"d.m.Y" }}
+      {% if inv.used_by %} · verwendet von {{ inv.used_by.display_name }}{% else %} · gültig bis {{ inv.expires_at|date:"d.m.Y H:i" }}{% endif %}
+    </div>
+    {% if inv.status == "open" %}
+    <form method="post" action="{% url 'accounts:admin_invitation_revoke' inv.pk %}">{% csrf_token %}<button class="button danger small">Widerrufen</button></form>
+    {% endif %}
+  </li>
+  {% endfor %}
+</ul>
+{% else %}
+<p class="muted">Noch keine Einladungen.</p>
+{% endif %}
+{% endblock %}

templates/accounts/admin/show_once.html

@@ -0,0 +1,16 @@
+{% extends "base.html" %}
+{% block title %}{{ title }}{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>{{ title }}</h1>
+  <div class="card">
+    <label for="secret-value">Nur jetzt sichtbar – bitte kopieren:</label>
+    <div class="copyrow">
+      <input id="secret-value" type="text" value="{{ value }}" readonly>
+      <button type="button" class="button" data-copy="#secret-value">Kopieren</button>
+    </div>
+    <p class="muted">{{ hint }}</p>
+  </div>
+  <p><a href="{% url 'accounts:admin_users' %}">Zurück zur Nutzerverwaltung</a> · <a href="{% url 'accounts:admin_invitations' %}">Einladungen</a></p>
+</div>
+{% endblock %}

templates/accounts/admin/users.html

@@ -0,0 +1,38 @@
+{% extends "base.html" %}
+{% block title %}Nutzer verwalten{% endblock %}
+{% block content %}
+<h1>Nutzer</h1>
+<p><a class="button" href="{% url 'accounts:admin_invitations' %}">Neue Einladung</a></p>
+<ul class="list">
+  {% for u in users %}
+  <li class="card{% if not u.is_active %} inactive{% endif %}">
+    <div class="row-head">
+      <strong>{{ u.display_name }}</strong>
+      <span class="badge">{{ u.get_role_display }}</span>
+      {% if not u.is_active %}<span class="badge badge-muted">deaktiviert</span>{% endif %}
+      {% if u.must_change_password %}<span class="badge badge-muted">temp. Passwort</span>{% endif %}
+    </div>
+    <div class="muted">{{ u.email }} · seit {{ u.date_joined|date:"d.m.Y" }}</div>
+    <details class="actions">
+      <summary>Aktionen</summary>
+      <div class="action-buttons">
+        {% if u.is_active %}
+          <form method="post" action="{% url 'accounts:admin_user_action' u.pk 'reset_link' %}">{% csrf_token %}<button class="button secondary">Reset-Link erzeugen</button></form>
+          <form method="post" action="{% url 'accounts:admin_user_action' u.pk 'temp_password' %}">{% csrf_token %}<button class="button secondary">Temporäres Passwort</button></form>
+          {% if u != user %}
+            {% if u.role == "admin" %}
+              <form method="post" action="{% url 'accounts:admin_user_action' u.pk 'make_user' %}">{% csrf_token %}<button class="button secondary">Zu Nutzer machen</button></form>
+            {% else %}
+              <form method="post" action="{% url 'accounts:admin_user_action' u.pk 'make_admin' %}">{% csrf_token %}<button class="button secondary">Zu Admin machen</button></form>
+            {% endif %}
+            <form method="post" action="{% url 'accounts:admin_user_action' u.pk 'deactivate' %}">{% csrf_token %}<button class="button danger">Deaktivieren</button></form>
+          {% endif %}
+        {% else %}
+          <form method="post" action="{% url 'accounts:admin_user_action' u.pk 'activate' %}">{% csrf_token %}<button class="button secondary">Aktivieren</button></form>
+        {% endif %}
+      </div>
+    </details>
+  </li>
+  {% endfor %}
+</ul>
+{% endblock %}

templates/accounts/already_logged_in.html

@@ -0,0 +1,12 @@
+{% extends "base.html" %}
+{% block title %}Bereits angemeldet{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Du bist bereits angemeldet</h1>
+  <p>Um mit diesem Einladungslink ein neues Konto anzulegen, melde dich zuerst ab. Der Link bleibt gültig.</p>
+  <form method="post" action="{% url 'accounts:logout' %}">
+    {% csrf_token %}
+    <button type="submit" class="button">Abmelden</button>
+  </form>
+</div>
+{% endblock %}

templates/accounts/link_invalid.html

@@ -0,0 +1,9 @@
+{% extends "base.html" %}
+{% block title %}Link ungültig{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Link ungültig</h1>
+  <p>Dieser {{ kind }} ist ungültig, abgelaufen oder wurde bereits verwendet. Bitte frag beim Admin nach einem neuen Link.</p>
+  <p><a href="{% url 'accounts:login' %}">Zur Anmeldung</a></p>
+</div>
+{% endblock %}

templates/accounts/login.html

@@ -0,0 +1,14 @@
+{% extends "base.html" %}
+{% block title %}Anmelden{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Anmelden</h1>
+  <form method="post" class="card" novalidate>
+    {% csrf_token %}
+    {% include "form_fields.html" %}
+    <input type="hidden" name="next" value="{{ next }}">
+    <button type="submit" class="button wide">Anmelden</button>
+  </form>
+  <p class="muted">Kein Konto? Die Registrierung ist nur mit einer Einladung möglich. Passwort vergessen? Bitte wende dich an den Admin.</p>
+</div>
+{% endblock %}

templates/accounts/password_change.html

@@ -0,0 +1,13 @@
+{% extends "base.html" %}
+{% block title %}Passwort ändern{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Passwort ändern</h1>
+  {% if forced %}<p class="msg msg-warning">Du hast ein temporäres Passwort erhalten. Bitte lege jetzt ein eigenes fest.</p>{% endif %}
+  <form method="post" class="card" novalidate>
+    {% csrf_token %}
+    {% include "form_fields.html" %}
+    <button type="submit" class="button wide">Passwort speichern</button>
+  </form>
+</div>
+{% endblock %}

templates/accounts/password_reset.html

@@ -0,0 +1,13 @@
+{% extends "base.html" %}
+{% block title %}Passwort zurücksetzen{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Neues Passwort</h1>
+  <p>Lege ein neues Passwort für <strong>{{ reset_user.email }}</strong> fest.</p>
+  <form method="post" class="card" novalidate>
+    {% csrf_token %}
+    {% include "form_fields.html" %}
+    <button type="submit" class="button wide">Passwort speichern</button>
+  </form>
+</div>
+{% endblock %}

templates/accounts/profile.html

@@ -0,0 +1,14 @@
+{% extends "base.html" %}
+{% block title %}Mein Konto{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Mein Konto</h1>
+  <p class="muted">{{ user.email }} · {{ user.get_role_display }}</p>
+  <form method="post" class="card" novalidate>
+    {% csrf_token %}
+    {% include "form_fields.html" %}
+    <button type="submit" class="button">Speichern</button>
+  </form>
+  <p><a href="{% url 'accounts:password_change' %}">Passwort ändern</a></p>
+</div>
+{% endblock %}

templates/accounts/register.html

@@ -0,0 +1,13 @@
+{% extends "base.html" %}
+{% block title %}Registrieren{% endblock %}
+{% block content %}
+<div class="narrow">
+  <h1>Konto anlegen</h1>
+  <p>Du wurdest zum Kochbuch eingeladen. Lege jetzt dein Konto an.</p>
+  <form method="post" class="card" novalidate>
+    {% csrf_token %}
+    {% include "form_fields.html" %}
+    <button type="submit" class="button wide">Konto anlegen</button>
+  </form>
+</div>
+{% endblock %}