feat: initialize backend with NestJS, PostgreSQL, and Prisma

- Add package.json for backend dependencies and scripts.
- Create Prisma schema for multi-tenant event management.
- Implement main application module and configure global settings.
- Develop authentication module with JWT and Authentik integration.
- Create DTOs for guest account creation and KC management.
- Implement role-based access control with custom guards and decorators.
- Add services and controllers for managing KCs and guest accounts.
- Set up global validation and CORS in the main application entry point.
- Establish Prisma module for database access throughout the application.
- Document project plan and architecture for multi-tenant platform.

src/auth/authentik.strategy.ts

@@ -0,0 +1,62 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import { Strategy } from 'passport-jwt';
+import * as jwksRsa from 'jwks-rsa';
+import { Request } from 'express';
+import { PrismaClient } from '../prisma/prisma.module';
+import { AuthenticatedUser } from './authenticated-request';
+
+interface AuthentikJwtPayload {
+  sub: string;
+  email: string;
+  given_name?: string;
+  family_name?: string;
+}
+
+/// Validates access tokens issued by Authentik (resource-server pattern):
+/// signature is checked against Authentik's JWKS, then the local Membership
+/// table decides what the user may do. Authentik itself is only the identity
+/// source, never asked for authorization here.
+@Injectable()
+export class AuthentikStrategy extends PassportStrategy(Strategy, 'authentik') {
+  constructor(
+    config: ConfigService,
+    private readonly prisma: PrismaClient,
+  ) {
+    const issuerUrl = config.getOrThrow<string>('AUTHENTIK_ISSUER_URL');
+    super({
+      jwtFromRequest: (req: Request) =>
+        req.headers.authorization?.startsWith('Bearer ')
+          ? req.headers.authorization.slice('Bearer '.length)
+          : null,
+      secretOrKeyProvider: jwksRsa.passportJwtSecret({
+        jwksUri: `${issuerUrl}/jwks/`,
+        cache: true,
+        rateLimit: true,
+      }),
+      issuer: issuerUrl,
+      algorithms: ['RS256'],
+    });
+  }
+
+  async validate(payload: AuthentikJwtPayload): Promise<AuthenticatedUser> {
+    const user = await this.prisma.user.findUnique({
+      where: { authentikSub: payload.sub },
+      include: { memberships: true },
+    });
+    if (!user) {
+      throw new UnauthorizedException('User not provisioned locally yet');
+    }
+    return {
+      userId: user.id,
+      authentikSub: user.authentikSub,
+      email: user.email,
+      memberships: user.memberships.map((m) => ({
+        kcId: m.kcId,
+        gemeindeId: m.gemeindeId,
+        role: m.role,
+      })),
+    };
+  }
+}