feat(backend): derive LEITUNGSTEAM from the Authentik groups claim

On every Authentik login the token's `groups` claim is compared against
AUTHENTIK_LEITUNGSTEAM_GROUP (default "Leitungsteam") and mirrored to the
new User.isLeitungsteam column. LT is global, not KC-scoped, so it lives on
the User rather than as a per-KC Membership row: toAuthenticatedUser()
synthesises a virtual global LEITUNGSTEAM membership from the flag, so
RolesGuard / visibility / TeamerService keep working unchanged.

- provision helper gains an isLeitungsteam arg and reconciles the flag both
  ways (grant on join, drop when the group is gone), capturing a User
  UPDATE to the sync log.
- verifyAuthentikClaims() now also returns isLeitungsteam; strategy, WS
  path and onboarding all funnel through the shared helper + mapper.
- new env var AUTHENTIK_LEITUNGSTEAM_GROUP.

Tests: provision-user.spec.ts extended (flag up/down, virtual membership);
npm test green at 55. Docs updated; ops note added that the Authentik
provider must emit the groups claim.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/onboarding/onboarding.service.ts

@@ -42,7 +42,7 @@ export class OnboardingService {
     if (!token) {
       throw new UnauthorizedException('Missing Authentik bearer token');
     }
-    const claims = await this.tokens.verifyAuthentikClaims(token);
+    const { isLeitungsteam, ...claims } = await this.tokens.verifyAuthentikClaims(token);
 
     const kc = await this.prisma.kc.findUnique({ where: { inviteCode } });
     if (!kc || !kc.isActive) {
@@ -53,7 +53,12 @@ export class OnboardingService {
       throw new BadRequestException('Gemeinde does not belong to this KC');
     }
 
-    const user = await resolveOrProvisionAuthentikUser(this.prisma, this.sync, claims);
+    const user = await resolveOrProvisionAuthentikUser(
+      this.prisma,
+      this.sync,
+      claims,
+      isLeitungsteam,
+    );
 
     const existing = await this.prisma.membership.findUnique({
       where: {