feat(chat): free-form GRUPPE channels with mutable participants

- ChatChannelType.GRUPPE: created by Leitungsteam (any KC) or a Gemeinde
  Verantwortliche/r (own KC), mixing team users and guests/Konfis as
  explicit ChatParticipant rows (unlike GEMEINDE_GRUPPE, membership is
  not derived from Gemeinde)
- POST /chat/:kcId/gruppen to create, GET participant-candidates, and
  POST/DELETE /chat/gruppen/:channelId/participants to manage membership
  (creator, LT, or Verantwortliche/r of that KC)
- ChatGateway broadcasts chat:participants-changed on membership change
- PushService updated for nullable ChatParticipant.userId + new
  guestAccountId column
- SyncService now replicates ChatParticipant
- Prisma migration + 14 new unit tests (75/75 passing), tsc clean
- CI: add .gitea/workflows/cybedefend-scan.yml + .cybedefend project config

prisma/migrations/20260912130000_chat_gruppe/migration.sql

@@ -0,0 +1,17 @@
+-- AlterEnum
+ALTER TYPE "ChatChannelType" ADD VALUE 'GRUPPE';
+
+-- AlterTable
+ALTER TABLE "ChatChannel" ADD COLUMN     "createdByUserId" TEXT,
+ADD COLUMN     "name" TEXT;
+
+-- AlterTable
+ALTER TABLE "ChatParticipant" ADD COLUMN     "guestAccountId" TEXT,
+ALTER COLUMN "userId" DROP NOT NULL;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ChatParticipant_channelId_guestAccountId_key" ON "ChatParticipant"("channelId", "guestAccountId");
+
+-- AddForeignKey
+ALTER TABLE "ChatParticipant" ADD CONSTRAINT "ChatParticipant_guestAccountId_fkey" FOREIGN KEY ("guestAccountId") REFERENCES "GuestAccount"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+