feat(backend): implement phases 0-6 (auth, kc, wahl, files, chat, sync)

Full NestJS backend for the KC-App platform:
- auth: Authentik OIDC resource-server strategy + guest invite-code JWT
  login, plus TokenVerificationService for the WS handshake path
- kc: Leitungsteam-only KC (event) creation/listing
- wahl: Wahl/Workshop admin, Force-Zuteilung overrides, ZuteilungService
  (port of the WP plugin's kc_run_zuteilung), CSV export
- files: LT-only upload with visibility tiers; list/download filtered by
  caller tier; StorageProvider abstraction (WebDAV/Nextcloud default, S3)
- chat: Gemeinde group / DM / LT-wide / broadcast channels; REST + raw ws
  gateway sharing ChatService access rules
- sync: append-only SyncLogEntry replication log + local<->cloud
  push/pull scheduler, shared-secret guarded
- common: Role enum, @Roles decorator, KC-scoped RolesGuard (LT global)
- serves client/web/ interim static web client under / (API under /api)

Typecheck, nest build and boot test pass; needs real Postgres/Authentik/
Nextcloud to run end to end.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/files/storage/webdav-storage.provider.ts

@@ -0,0 +1,37 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { randomUUID } from 'crypto';
+import { createClient, WebDAVClient } from 'webdav';
+import { StorageProvider } from './storage-provider';
+
+/// Nextcloud (or any WebDAV server) as file storage backend.
+@Injectable()
+export class WebDavStorageProvider implements StorageProvider {
+  private readonly client: WebDAVClient;
+
+  constructor(config: ConfigService) {
+    this.client = createClient(config.getOrThrow<string>('WEBDAV_URL'), {
+      username: config.getOrThrow<string>('WEBDAV_USERNAME'),
+      password: config.getOrThrow<string>('WEBDAV_PASSWORD'),
+    });
+  }
+
+  async upload(kcId: string, filename: string, data: Buffer): Promise<string> {
+    const dir = `/${kcId}`;
+    if (!(await this.client.exists(dir))) {
+      await this.client.createDirectory(dir, { recursive: true });
+    }
+    const storageKey = `${dir}/${randomUUID()}-${filename}`;
+    await this.client.putFileContents(storageKey, data, { overwrite: false });
+    return storageKey;
+  }
+
+  async download(storageKey: string): Promise<Buffer> {
+    const content = await this.client.getFileContents(storageKey);
+    return Buffer.isBuffer(content) ? content : Buffer.from(content as ArrayBuffer);
+  }
+
+  async delete(storageKey: string): Promise<void> {
+    await this.client.deleteFile(storageKey);
+  }
+}