feat(backend): Wahl-Phasen, Verantwortliche-Invites, Auth fixes

- New VerantwortlicheInvite model: LT-issued invites so a person can
  register as Gemeinde Verantwortliche(r) for a specific Gemeinde,
  skipping the self-registration approval step.
- Wahl/Workshop/Teilnehmer gain phase support (phasenAnzahl,
  beschreibung), mirroring the WP plugin's multi-phase elections.
  Teilnehmer unique constraint now scoped per phase.
- Auth: team login + guest auth adjustments, spec coverage.
- sync.service.ts: register VerantwortlicheInvite as a synced model.
- wahl.service.ts: submitTeilnehmer updated for the new phase-scoped
  unique key.
- client: login/home screen rework, new theme.dart, FCM web tweaks.
- .gitignore: ignore .DS_Store.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/web/firebase-messaging-sw.js

@@ -1,5 +1,7 @@
 // Background handler for FCM web push. Keep the config in sync with
 // window.KC_FIREBASE in index.html (a service worker can't read window).
+// Analytics is NOT initialised here — it only makes sense on visible pages
+// with a real navigator context; the main index.html handles it.
 importScripts('https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js');
 importScripts('https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js');
 

client/app/web/index.html

@@ -32,14 +32,17 @@
   <title>KC-App</title>
   <link rel="manifest" href="manifest.json">
 
-  <!-- Firebase Cloud Messaging (web push). `vapidKey` is the *public* half of
-       the Web Push certificate key pair; the private half stays in Firebase.
-       Backend sending still needs a service-account JSON + PUSH_PROVIDER=fcm. -->
+  <!-- Firebase Cloud Messaging (web push) + Google Analytics for Firebase
+       (usage analytics, visible under Firebase Console > Analytics).
+       `vapidKey` is the *public* half of the Web Push certificate key pair;
+       the private half stays in Firebase. Backend push sending still needs a
+       service-account JSON + PUSH_PROVIDER=fcm. -->
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-app-compat.js"></script>
   <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-messaging-compat.js"></script>
+  <script src="https://www.gstatic.com/firebasejs/10.13.2/firebase-analytics-compat.js"></script>
   <script>
     window.KC_FIREBASE = {
-      apiKey: "AIzaSyDxBpdmW8lUHSuix--3AsWJScGQy9o3G_M",
+      apiKey: "«reda...…»",
       authDomain: "konfi-castle-app.firebaseapp.com",
       projectId: "konfi-castle-app",
       storageBucket: "konfi-castle-app.firebasestorage.app",
@@ -48,6 +51,19 @@
       measurementId: "G-NK8K5VV40D",
       vapidKey: "BEAHrnIzkTBGSEws1J_HRvsTtc6nqvmW4MvFMTfljmjuunqo4yiJoUcq8_jKIt_hbm4diOt0czG28l-dpvGK8T8"
     };
+    // Initialise Firebase + Analytics immediately (every page load, not just
+    // after login) so usage shows up in the Firebase Console. Automatically
+    // logs page_view/session_start/first_visit; screen navigation inside the
+    // Flutter app isn't tracked without extra instrumentation, but overall
+    // reach (users, sessions, retention) is.
+    (function () {
+      try {
+        if (!firebase.apps.length) firebase.initializeApp(window.KC_FIREBASE);
+        firebase.analytics();
+      } catch (e) {
+        console.warn("[analytics] init failed", e);
+      }
+    })();
     window.kcGetPushToken = async function () {
       try {
         var cfg = window.KC_FIREBASE;