feat(backend): derive LEITUNGSTEAM from the Authentik groups claim

On every Authentik login the token's `groups` claim is compared against
AUTHENTIK_LEITUNGSTEAM_GROUP (default "Leitungsteam") and mirrored to the
new User.isLeitungsteam column. LT is global, not KC-scoped, so it lives on
the User rather than as a per-KC Membership row: toAuthenticatedUser()
synthesises a virtual global LEITUNGSTEAM membership from the flag, so
RolesGuard / visibility / TeamerService keep working unchanged.

- provision helper gains an isLeitungsteam arg and reconciles the flag both
  ways (grant on join, drop when the group is gone), capturing a User
  UPDATE to the sync log.
- verifyAuthentikClaims() now also returns isLeitungsteam; strategy, WS
  path and onboarding all funnel through the shared helper + mapper.
- new env var AUTHENTIK_LEITUNGSTEAM_GROUP.

Tests: provision-user.spec.ts extended (flag up/down, virtual membership);
npm test green at 55. Docs updated; ops note added that the Authentik
provider must emit the groups claim.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/.env.example

@@ -4,6 +4,11 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/kcapp?schema=public"
 # Authentik OIDC issuer, e.g. https://auth.example.org/application/o/kc-app/
 AUTHENTIK_ISSUER_URL="https://authentik.example.org/application/o/kc-app"
 
+# Name of the Authentik group whose members are Leitungsteam. Mirrored to
+# User.isLeitungsteam on every login (the access token must carry a `groups`
+# claim; add the "groups" scope to the Authentik provider).
+AUTHENTIK_LEITUNGSTEAM_GROUP="Leitungsteam"
+
 # Secret used to sign guest/Konfi session tokens (local accounts only)
 GUEST_JWT_SECRET="change-me"