Add phase 1: Docker setup, auth with invitations and roles

- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes,
  healthcheck on /healthz, test profile running pytest against Postgres)
- Custom e-mail user model with user/admin roles
- Invitation-only registration with single-use, hashed, expiring links
- Admin area: invitations, role changes, deactivation, password reset
  via one-time link or temporary password (forced change on login)
- First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup
- Login rate limiting per e-mail and IP (DB-backed, worker-safe)
- Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES,
  optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP)
- Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies
- Mobile-first German UI, CLAUDE.md, README, init-env script
- 65 tests for auth, permissions, proxy handling and rate limiting

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/conftest.py

@@ -0,0 +1,37 @@
+import pytest
+from django.test import Client
+
+from accounts.models import User
+
+PASSWORD = "Sehr-sicheres-Passwort-42"
+
+
+@pytest.fixture
+def admin_user(db):
+    return User.objects.create_admin(email="[email protected]", password=PASSWORD, display_name="Admin")
+
+
+@pytest.fixture
+def user(db):
+    return User.objects.create_user(email="[email protected]", password=PASSWORD, display_name="Anna")
+
+
+@pytest.fixture
+def other_user(db):
+    return User.objects.create_user(email="[email protected]", password=PASSWORD, display_name="Ben")
+
+
+def logged_in_client(u):
+    c = Client()
+    c.force_login(u)
+    return c
+
+
+@pytest.fixture
+def admin_client(admin_user):
+    return logged_in_client(admin_user)
+
+
+@pytest.fixture
+def user_client(user):
+    return logged_in_client(user)