feat(backend): Wahl-Phasen, Verantwortliche-Invites, Auth fixes

- New VerantwortlicheInvite model: LT-issued invites so a person can
  register as Gemeinde Verantwortliche(r) for a specific Gemeinde,
  skipping the self-registration approval step.
- Wahl/Workshop/Teilnehmer gain phase support (phasenAnzahl,
  beschreibung), mirroring the WP plugin's multi-phase elections.
  Teilnehmer unique constraint now scoped per phase.
- Auth: team login + guest auth adjustments, spec coverage.
- sync.service.ts: register VerantwortlicheInvite as a synced model.
- wahl.service.ts: submitTeilnehmer updated for the new phase-scoped
  unique key.
- client: login/home screen rework, new theme.dart, FCM web tweaks.
- .gitignore: ignore .DS_Store.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -7,6 +7,8 @@ services:
       POSTGRES_DB: kcapp
     volumes:
       - pgdata:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres -d kcapp"]
       interval: 5s
@@ -29,9 +31,9 @@ services:
       DATABASE_URL: postgresql://postgres:postgres@db:5432/kcapp?schema=public
       PORT: "3000"
       GOOGLE_APPLICATION_CREDENTIALS: /app/serviceAccount.json
-      APP_BASE_URL: http://localhost:3000
+      APP_BASE_URL: http://localhost:3010
     ports:
-      - "3000:3000"
+      - "3010:3000"
     volumes:
       # Firebase service account — kept out of the image, mounted read-only.
       - ./backend/serviceAccount.json:/app/serviceAccount.json:ro