feat(backend): add GemeindeController for LT congregation CRUD

Fills the plan's known gap where Gemeinde existed only as a Prisma model.
GemeindeModule exposes Leitungsteam-only create/list/get/update/delete
under /api/gemeinde, each mutation captured into the sync log like the
other feature services. Unique-name-per-KC violations surface as 409.
Docs (plan + backend README) updated to drop the gap and next-step item.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/gemeinde/gemeinde.controller.ts

@@ -0,0 +1,53 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+import { GemeindeService } from './gemeinde.service';
+import { CreateGemeindeDto } from './dto/create-gemeinde.dto';
+import { UpdateGemeindeDto } from './dto/update-gemeinde.dto';
+import { Roles } from '../common/roles.decorator';
+import { RolesGuard } from '../common/roles.guard';
+import { Role } from '../common/role.enum';
+
+/// Gemeinde (congregation) management. Reserved for the Leitungsteam, which is
+/// global across all KCs (see RolesGuard); Gemeinde Verantwortliche/Teamer
+/// learn their own Gemeinde from their Membership, not from this endpoint.
+@Controller('gemeinde')
+@UseGuards(AuthGuard('authentik'), RolesGuard)
+@Roles(Role.LEITUNGSTEAM)
+export class GemeindeController {
+  constructor(private readonly gemeinde: GemeindeService) {}
+
+  @Post()
+  create(@Body() dto: CreateGemeindeDto) {
+    return this.gemeinde.create(dto.kcId, dto.name);
+  }
+
+  @Get()
+  list(@Query('kcId') kcId: string) {
+    return this.gemeinde.list(kcId);
+  }
+
+  @Get(':id')
+  get(@Param('id') id: string) {
+    return this.gemeinde.get(id);
+  }
+
+  @Patch(':id')
+  update(@Param('id') id: string, @Body() dto: UpdateGemeindeDto) {
+    return this.gemeinde.update(id, dto.name);
+  }
+
+  @Delete(':id')
+  remove(@Param('id') id: string) {
+    return this.gemeinde.remove(id);
+  }
+}