Add phase 1: Docker setup, auth with invitations and roles

- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes,
  healthcheck on /healthz, test profile running pytest against Postgres)
- Custom e-mail user model with user/admin roles
- Invitation-only registration with single-use, hashed, expiring links
- Admin area: invitations, role changes, deactivation, password reset
  via one-time link or temporary password (forced change on login)
- First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup
- Login rate limiting per e-mail and IP (DB-backed, worker-safe)
- Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES,
  optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP)
- Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies
- Mobile-first German UI, CLAUDE.md, README, init-env script
- 65 tests for auth, permissions, proxy handling and rate limiting

Co-Authored-By: Claude Opus 5.5 <[email protected]>

templates/accounts/admin/invitations.html

@@ -0,0 +1,35 @@
+{% extends "base.html" %}
+{% block title %}Einladungen{% endblock %}
+{% block content %}
+<h1>Einladungen</h1>
+<form method="post" class="card" novalidate>
+  {% csrf_token %}
+  <h2>Neue Einladung</h2>
+  {% include "form_fields.html" %}
+  <button type="submit" class="button">Einladungslink erzeugen</button>
+</form>
+
+<h2>Bisherige Einladungen</h2>
+{% if invitations %}
+<ul class="list">
+  {% for inv in invitations %}
+  <li class="card">
+    <div class="row-head">
+      <strong>{{ inv.note|default:inv.email|default:"Einladung" }}</strong>
+      <span class="badge{% if inv.status != 'open' %} badge-muted{% endif %}">{{ inv.status_label }}</span>
+      <span class="badge badge-muted">{{ inv.get_role_display }}</span>
+    </div>
+    <div class="muted">
+      {% if inv.email %}{{ inv.email }} · {% endif %}erstellt {{ inv.created_at|date:"d.m.Y" }}
+      {% if inv.used_by %} · verwendet von {{ inv.used_by.display_name }}{% else %} · gültig bis {{ inv.expires_at|date:"d.m.Y H:i" }}{% endif %}
+    </div>
+    {% if inv.status == "open" %}
+    <form method="post" action="{% url 'accounts:admin_invitation_revoke' inv.pk %}">{% csrf_token %}<button class="button danger small">Widerrufen</button></form>
+    {% endif %}
+  </li>
+  {% endfor %}
+</ul>
+{% else %}
+<p class="muted">Noch keine Einladungen.</p>
+{% endif %}
+{% endblock %}