feat(backend): implement phases 0-6 (auth, kc, wahl, files, chat, sync)

Full NestJS backend for the KC-App platform:
- auth: Authentik OIDC resource-server strategy + guest invite-code JWT
  login, plus TokenVerificationService for the WS handshake path
- kc: Leitungsteam-only KC (event) creation/listing
- wahl: Wahl/Workshop admin, Force-Zuteilung overrides, ZuteilungService
  (port of the WP plugin's kc_run_zuteilung), CSV export
- files: LT-only upload with visibility tiers; list/download filtered by
  caller tier; StorageProvider abstraction (WebDAV/Nextcloud default, S3)
- chat: Gemeinde group / DM / LT-wide / broadcast channels; REST + raw ws
  gateway sharing ChatService access rules
- sync: append-only SyncLogEntry replication log + local<->cloud
  push/pull scheduler, shared-secret guarded
- common: Role enum, @Roles decorator, KC-scoped RolesGuard (LT global)
- serves client/web/ interim static web client under / (API under /api)

Typecheck, nest build and boot test pass; needs real Postgres/Authentik/
Nextcloud to run end to end.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/sync/sync-scheduler.service.ts

@@ -0,0 +1,32 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Interval } from '@nestjs/schedule';
+import { SyncService } from './sync.service';
+
+/// Periodically pushes/pulls against the configured peer when enabled. Safe
+/// to fail silently (e.g. no internet at an on-site event) - just retries
+/// on the next tick.
+@Injectable()
+export class SyncSchedulerService {
+  private readonly logger = new Logger(SyncSchedulerService.name);
+
+  constructor(
+    private readonly sync: SyncService,
+    private readonly config: ConfigService,
+  ) {}
+
+  @Interval(30_000)
+  async tick() {
+    if (this.config.get<string>('SYNC_ENABLED') !== 'true') return;
+    const peerUrl = this.config.get<string>('SYNC_PEER_URL');
+    const peerSecret = this.config.get<string>('SYNC_SHARED_SECRET');
+    if (!peerUrl || !peerSecret) return;
+
+    try {
+      await this.sync.pushToPeer(peerUrl, peerSecret);
+      await this.sync.pullFromPeer(peerUrl, peerSecret);
+    } catch (err) {
+      this.logger.debug(`Sync with peer skipped: ${(err as Error).message}`);
+    }
+  }
+}