feat(backend): local accounts + invites for Gemeinde Teamer

Per the updated plan, Gemeinde Teamer are no longer Authentik-backed; they
are local accounts a Gemeinde Verantwortliche/r provisions per KC.

Schema:
- User.authentikSub now nullable; add passwordHash + kcId (cascade from Kc)
  so one User model covers Authentik members and local Teamer.
- new TeamerInvite model: shareable group link (email null, maxUses null)
  or personal invite (email pinned, single use), with expiry + revoke.
- sync log now also replicates User / Membership / TeamerInvite.

Auth:
- TeamAuthService: bcrypt password login (POST /auth/team-login) and invite
  redemption (POST /auth/teamer/register) issuing a JWT signed with
  TEAM_JWT_SECRET, payload typ:"team".
- TeamJwtStrategy (AuthGuard('team')) resolves it to the same
  AuthenticatedUser shape as AuthentikStrategy.
- TokenVerificationService.verifyEither() also accepts team tokens (WS).
- files + chat read endpoints accept 'team' tokens; Teamer see non-Konfi
  files and can use chat / start DMs.

Teamer admin (teamer/ module, under /gemeinde/:gemeindeId):
- POST/GET teamer, DELETE teamer/:userId
- POST/GET teamer-invites, DELETE teamer-invites/:inviteId
- LT may manage any Gemeinde; a Verantwortliche/r only their own
  (checked in TeamerService, since RolesGuard only scopes by kcId).

Tests: TeamAuthService + TeamerService specs added (Prisma/Sync mocked),
npm test green at 32. Docs (plan + backend README) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/README.md

@@ -7,7 +7,7 @@ architecture context).
 
 ```bash
 npm install
-cp .env.example .env   # then fill in DATABASE_URL / AUTHENTIK_ISSUER_URL / GUEST_JWT_SECRET
+cp .env.example .env   # then fill in DATABASE_URL / AUTHENTIK_ISSUER_URL / GUEST_JWT_SECRET / TEAM_JWT_SECRET
 npx prisma generate
 npx prisma migrate dev --name init   # requires a running PostgreSQL instance
 npm run start:dev
@@ -20,12 +20,20 @@ client's host - no separate web server is needed.
 
 ## Auth model
 
-- Team members (Leitungsteam, Gemeinde Verantwortliche, Gemeinde Teamer) are
-  provisioned in Authentik; this API acts as an OIDC **resource server**,
+- Leitungsteam and Gemeinde Verantwortliche are provisioned in Authentik
+  (the "Konfi-Castle-ID"); this API acts as an OIDC **resource server**,
   verifying access tokens against Authentik's JWKS (`AuthentikStrategy`) and
   then resolving local `Membership` rows to determine role + KC/Gemeinde
   scope. Clients perform the actual Authorization Code + PKCE flow against
   Authentik directly.
+- Gemeinde Teamer are **local accounts** (no Authentik): a `User` row with a
+  `passwordHash` and `kcId` set, `authentikSub` left null. A Gemeinde
+  Verantwortliche/r creates them directly or via a `TeamerInvite`
+  (shareable group link or per-email invite). Login is `POST /auth/team-login`
+  (email + password) or `POST /auth/teamer/register` (redeem an invite
+  token); both return a JWT signed with `TEAM_JWT_SECRET` and carrying
+  `typ: "team"`. `TeamJwtStrategy` (`AuthGuard('team')`) resolves it to the
+  same shape as `AuthentikStrategy`, so guards/controllers treat both alike.
 - Guests/Konfis get a temporary local account (first/last name required, no
   Authentik) created via `POST /auth/guest` with a KC invite code, returning
   a JWT signed with `GUEST_JWT_SECRET`.
@@ -33,13 +41,24 @@ client's host - no separate web server is needed.
 ## Modules implemented so far
 
 - `prisma/` — shared `PrismaClient` provider.
-- `auth/` — Authentik resource-server strategy (`AuthGuard('authentik')`) +
-  guest invite-code login issuing a locally-signed JWT (`AuthGuard('guest')`).
+- `auth/` — Authentik resource-server strategy (`AuthGuard('authentik')`),
+  guest invite-code login (`AuthGuard('guest')`), and local Gemeinde Teamer
+  auth (`AuthGuard('team')`): `POST /auth/team-login` and
+  `POST /auth/teamer/register` (invite redemption), bcrypt hashes, tokens
+  signed with `TEAM_JWT_SECRET`. `TokenVerificationService` (WS handshake)
+  now accepts Authentik, team, or guest tokens.
 - `kc/` — KC (event) creation/listing, Leitungsteam-only.
 - `gemeinde/` — Gemeinde (congregation) CRUD per KC (`POST /gemeinde`,
   `GET /gemeinde?kcId=`, `GET/PATCH/DELETE /gemeinde/:id`), Leitungsteam-only.
   Gemeinde Verantwortliche/Teamer get their own Gemeinde from their
   `Membership`, not from this endpoint.
+- `teamer/` — local Gemeinde Teamer accounts + invites, under
+  `/gemeinde/:gemeindeId/...`: `POST/GET teamer`,
+  `DELETE teamer/:userId`, `POST/GET teamer-invites`,
+  `DELETE teamer-invites/:inviteId`. Callable by Leitungsteam (any Gemeinde)
+  or a Verantwortliche/r for their own Gemeinde (enforced in `TeamerService`,
+  since `RolesGuard` only scopes by `kcId`). Files/chat read endpoints accept
+  `'team'` tokens too, so Teamer see non-Konfi files and chat.
 - `wahl/` — Wahl/Workshop administration (Leitungsteam-only), guest
   Teilnehmer submission, Force-Zuteilung overrides, and `ZuteilungService`:
   a faithful port of the WP plugin's `kc_run_zuteilung` (force-assignments →
@@ -76,5 +95,8 @@ client's host - no separate web server is needed.
 - `common/` — `Role` enum, `@Roles()` decorator, `RolesGuard` (KC-scoped,
   Leitungsteam roles are global across all KCs).
 
-All planned backend phases are implemented; remaining work is the Flutter
-clients (see repo root README).
+All planned backend phases are implemented. `npm test` runs Jest unit tests
+(`ZuteilungService`, `TeamAuthService`, `TeamerService`; Prisma mocked).
+Remaining work: the Flutter clients (see repo root README), Authentik
+provisioning for LT/Verantwortliche, and the first real Prisma migration
+(only `schema.prisma` exists so far).