feat(chat): free-form GRUPPE channels with mutable participants

- ChatChannelType.GRUPPE: created by Leitungsteam (any KC) or a Gemeinde
  Verantwortliche/r (own KC), mixing team users and guests/Konfis as
  explicit ChatParticipant rows (unlike GEMEINDE_GRUPPE, membership is
  not derived from Gemeinde)
- POST /chat/:kcId/gruppen to create, GET participant-candidates, and
  POST/DELETE /chat/gruppen/:channelId/participants to manage membership
  (creator, LT, or Verantwortliche/r of that KC)
- ChatGateway broadcasts chat:participants-changed on membership change
- PushService updated for nullable ChatParticipant.userId + new
  guestAccountId column
- SyncService now replicates ChatParticipant
- Prisma migration + 14 new unit tests (75/75 passing), tsc clean
- CI: add .gitea/workflows/cybedefend-scan.yml + .cybedefend project config

.gitea/workflows/cybedefend-scan.yml

@@ -0,0 +1,51 @@
+name: CybeDefend Security Scan
+
+on:
+  push:
+    branches:
+      - main
+      - master
+      - 'feat/**'
+  pull_request:
+    branches:
+      - main
+      - master
+
+jobs:
+  cybedefend_scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run CybeDefend Security Scan
+        env:
+          CYBEDEFEND_PAT: ${{ secrets.CYBEDEFEND_PAT }}
+          CYBEDEFEND_PROJECT_ID: ${{ secrets.CYBEDEFEND_PROJECT_ID }}
+        run: |
+          docker run --rm \
+            -v "${{ gitea.workspace }}":/app -w /app \
+            -e CYBEDEFEND_PAT="$CYBEDEFEND_PAT" \
+            -e CYBEDEFEND_PROJECT_ID="$CYBEDEFEND_PROJECT_ID" \
+            ghcr.io/cybedefend/cybedefend-cli:latest \
+            scan --dir . --region eu --ci --break-on-severity critical
+
+      - name: Fetch detailed SARIF results
+        if: always()
+        env:
+          CYBEDEFEND_PAT: ${{ secrets.CYBEDEFEND_PAT }}
+          CYBEDEFEND_PROJECT_ID: ${{ secrets.CYBEDEFEND_PROJECT_ID }}
+        run: |
+          docker run --rm \
+            -v "${{ gitea.workspace }}":/app -w /app \
+            -e CYBEDEFEND_PAT="$CYBEDEFEND_PAT" \
+            -e CYBEDEFEND_PROJECT_ID="$CYBEDEFEND_PROJECT_ID" \
+            ghcr.io/cybedefend/cybedefend-cli:latest \
+            results --project-id "$CYBEDEFEND_PROJECT_ID" --all --output sarif --filename results.sarif --ci
+
+      - name: Upload scan results as artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cybedefend-results
+          path: results.sarif