feat(backend): implement phases 0-6 (auth, kc, wahl, files, chat, sync)

Full NestJS backend for the KC-App platform:
- auth: Authentik OIDC resource-server strategy + guest invite-code JWT
  login, plus TokenVerificationService for the WS handshake path
- kc: Leitungsteam-only KC (event) creation/listing
- wahl: Wahl/Workshop admin, Force-Zuteilung overrides, ZuteilungService
  (port of the WP plugin's kc_run_zuteilung), CSV export
- files: LT-only upload with visibility tiers; list/download filtered by
  caller tier; StorageProvider abstraction (WebDAV/Nextcloud default, S3)
- chat: Gemeinde group / DM / LT-wide / broadcast channels; REST + raw ws
  gateway sharing ChatService access rules
- sync: append-only SyncLogEntry replication log + local<->cloud
  push/pull scheduler, shared-secret guarded
- common: Role enum, @Roles decorator, KC-scoped RolesGuard (LT global)
- serves client/web/ interim static web client under / (API under /api)

Typecheck, nest build and boot test pass; needs real Postgres/Authentik/
Nextcloud to run end to end.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/sync/sync.controller.ts

@@ -0,0 +1,45 @@
+import { Body, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import { SyncService } from './sync.service';
+import { SyncSecretGuard } from './sync-secret.guard';
+import { IngestEntriesDto } from './dto/ingest-entries.dto';
+import { Roles } from '../common/roles.decorator';
+import { RolesGuard } from '../common/roles.guard';
+import { Role } from '../common/role.enum';
+
+@Controller('sync')
+export class SyncController {
+  constructor(
+    private readonly sync: SyncService,
+    private readonly config: ConfigService,
+  ) {}
+
+  /// Peer pushes its new entries to us.
+  @Post('ingest')
+  @UseGuards(SyncSecretGuard)
+  async ingest(@Body() dto: IngestEntriesDto) {
+    await this.sync.applyIncoming(dto.entries as never);
+    return { applied: dto.entries.length };
+  }
+
+  /// Peer pulls our new entries since their last known sequence.
+  @Get('export')
+  @UseGuards(SyncSecretGuard)
+  async export(@Query('since') since: string) {
+    const entries = await this.sync.getEntriesSince(Number(since) || 0);
+    return { entries };
+  }
+
+  /// Manual on-demand push+pull against the configured peer (Leitungsteam-only).
+  @Post('trigger')
+  @UseGuards(AuthGuard('authentik'), RolesGuard)
+  @Roles(Role.LEITUNGSTEAM)
+  async trigger() {
+    const peerUrl = this.config.getOrThrow<string>('SYNC_PEER_URL');
+    const peerSecret = this.config.getOrThrow<string>('SYNC_SHARED_SECRET');
+    const pushed = await this.sync.pushToPeer(peerUrl, peerSecret);
+    const pulled = await this.sync.pullFromPeer(peerUrl, peerSecret);
+    return { ...pushed, ...pulled };
+  }
+}