feat: initialize backend with NestJS, PostgreSQL, and Prisma

- Add package.json for backend dependencies and scripts.
- Create Prisma schema for multi-tenant event management.
- Implement main application module and configure global settings.
- Develop authentication module with JWT and Authentik integration.
- Create DTOs for guest account creation and KC management.
- Implement role-based access control with custom guards and decorators.
- Add services and controllers for managing KCs and guest accounts.
- Set up global validation and CORS in the main application entry point.
- Establish Prisma module for database access throughout the application.
- Document project plan and architecture for multi-tenant platform.

README.md

@@ -0,0 +1,37 @@
+# KC-App Backend
+
+NestJS API for the KC-App platform (see repo root README + plan for
+architecture context).
+
+## Setup
+
+```bash
+npm install
+cp .env.example .env   # then fill in DATABASE_URL / AUTHENTIK_ISSUER_URL / GUEST_JWT_SECRET
+npx prisma generate
+npx prisma migrate dev --name init   # requires a running PostgreSQL instance
+npm run start:dev
+```
+
+## Auth model
+
+- Team members (Leitungsteam, Gemeinde Verantwortliche, Gemeinde Teamer) are
+  provisioned in Authentik; this API acts as an OIDC **resource server**,
+  verifying access tokens against Authentik's JWKS (`AuthentikStrategy`) and
+  then resolving local `Membership` rows to determine role + KC/Gemeinde
+  scope. Clients perform the actual Authorization Code + PKCE flow against
+  Authentik directly.
+- Guests/Konfis get a temporary local account (first/last name required, no
+  Authentik) created via `POST /auth/guest` with a KC invite code, returning
+  a JWT signed with `GUEST_JWT_SECRET`.
+
+## Modules implemented so far
+
+- `prisma/` — shared `PrismaClient` provider.
+- `auth/` — Authentik resource-server strategy + guest invite-code login.
+- `kc/` — KC (event) creation/listing, Leitungsteam-only.
+- `common/` — `Role` enum, `@Roles()` decorator, `RolesGuard` (KC-scoped,
+  Leitungsteam roles are global across all KCs).
+
+Not yet implemented: Wahl/Workshop/Zuteilung engine, file sharing, chat
+realtime gateway, local/cloud sync engine.