feat: Authentik OIDC login (PKCE) + Leitungsteam admin screens

Backend:
- AuthentikStrategy / TokenVerificationService: normalise the issuer's
  trailing slash and accept both `iss` spellings (Authentik's discovery
  issuer and token `iss` carry a trailing slash; the JWKS URL must not
  double it). Wire the real konfi-castle issuer into .env.example.
- team token path now goes through toAuthenticatedUser too, so a local
  account flagged isLeitungsteam gets the synthetic global LT membership
  regardless of token kind.
- LT-admin controllers (kc, gemeinde, onboarding, sync, teamer) accept
  ['authentik','team'] so such an account can use them. RolesGuard still
  enforces the actual LT/role check.
- app.module serves the Flutter web build from client/app/build/web (SPA
  fallback covers the OIDC redirect path /v1/auth/callback), falling back
  to the interim client/web/ if it isn't built.

Client (client/app/):
- oidc.dart: Authorization-Code + PKCE against Authentik (discovery, S256
  challenge, state, token exchange, refresh). Browser bits (sessionStorage,
  redirect, URL) behind a conditional import so `flutter test` still
  compiles on the VM.
- AppState handles the ?code= callback on bootstrap, stores access +
  refresh, refreshes an expired token on restart.
- Login screen: "Mit Konfi-Castle-ID anmelden" button (Leitungsteam /
  Verantwortliche) alongside the local Teamer password form.
- admin_screen.dart: LT-only "Verwaltung" — list/create KCs, per KC the
  Gemeinden (list/create) and pending Verantwortlichen requests
  (approve/reject). Verified end to end against local Postgres with an
  isLeitungsteam account (create KC/Gemeinde, list + approve a request).

flutter analyze/test/build web green; backend npm test 56.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/lib/api.dart

@@ -4,6 +4,8 @@ import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 import 'package:shared_preferences/shared_preferences.dart';
 
+import 'oidc.dart';
+
 /// Backend base URL. Override at build/run time with
 /// `--dart-define=API_BASE=https://...`.
 const String kApiBase = String.fromEnvironment(
@@ -91,6 +93,55 @@ class Membership {
       );
 }
 
+class Kc {
+  Kc({required this.id, required this.name, required this.inviteCode, required this.isActive});
+  final String id;
+  final String name;
+  final String inviteCode;
+  final bool isActive;
+  factory Kc.fromJson(Map<String, dynamic> j) => Kc(
+        id: j['id'] as String,
+        name: j['name'] as String,
+        inviteCode: j['inviteCode'] as String? ?? '',
+        isActive: j['isActive'] as bool? ?? true,
+      );
+}
+
+class Gemeinde {
+  Gemeinde({required this.id, required this.name, required this.kcId});
+  final String id;
+  final String name;
+  final String kcId;
+  factory Gemeinde.fromJson(Map<String, dynamic> j) => Gemeinde(
+        id: j['id'] as String,
+        name: j['name'] as String,
+        kcId: j['kcId'] as String? ?? '',
+      );
+}
+
+class OnboardingRequest {
+  OnboardingRequest({
+    required this.id,
+    required this.userName,
+    required this.userEmail,
+    required this.gemeindeName,
+  });
+  final String id;
+  final String userName;
+  final String userEmail;
+  final String gemeindeName;
+  factory OnboardingRequest.fromJson(Map<String, dynamic> j) {
+    final u = j['user'] as Map<String, dynamic>? ?? const {};
+    final g = j['gemeinde'] as Map<String, dynamic>? ?? const {};
+    return OnboardingRequest(
+      id: j['id'] as String,
+      userName: [u['firstName'], u['lastName']].whereType<String>().join(' ').trim(),
+      userEmail: u['email'] as String? ?? '',
+      gemeindeName: g['name'] as String? ?? '',
+    );
+  }
+}
+
 class Workshop {
   Workshop({required this.id, required this.name, required this.kapazitaet});
   final String id;
@@ -326,6 +377,31 @@ class Api {
     );
   }
 
+  // --- LT admin ---
+  Future<List<Kc>> kcs() async {
+    final list = await _get('/kc') as List<dynamic>;
+    return list.map((e) => Kc.fromJson(e as Map<String, dynamic>)).toList();
+  }
+
+  Future<Kc> createKc(String name) async =>
+      Kc.fromJson(await _post('/kc', {'name': name}) as Map<String, dynamic>);
+
+  Future<List<Gemeinde>> gemeinden(String kcId) async {
+    final list = await _get('/gemeinde?kcId=$kcId') as List<dynamic>;
+    return list.map((e) => Gemeinde.fromJson(e as Map<String, dynamic>)).toList();
+  }
+
+  Future<Gemeinde> createGemeinde(String kcId, String name) async => Gemeinde.fromJson(
+      await _post('/gemeinde', {'kcId': kcId, 'name': name}) as Map<String, dynamic>);
+
+  Future<List<OnboardingRequest>> onboardingRequests(String kcId) async {
+    final list = await _get('/onboarding/requests?kcId=$kcId') as List<dynamic>;
+    return list.map((e) => OnboardingRequest.fromJson(e as Map<String, dynamic>)).toList();
+  }
+
+  Future<void> approveOnboarding(String id) => _post('/onboarding/requests/$id/approve', null);
+  Future<void> rejectOnboarding(String id) => _post('/onboarding/requests/$id/reject', null);
+
   // --- chat: REST for channels/history; live send/receive is the /chat WS ---
   Future<List<ChatChannel>> channels(String kcId) async {
     final list = await _get('/chat/$kcId/channels') as List<dynamic>;
@@ -341,43 +417,83 @@ class Api {
 /// App-wide session + auth actions. Persists the token in shared_preferences
 /// (localStorage on web).
 class AppState extends ChangeNotifier {
-  AppState(this._api);
+  AppState(this._api, {OidcClient? oidc}) : _oidc = oidc ?? OidcClient(http.Client());
   final Api _api;
+  final OidcClient _oidc;
 
   static const _tokenKey = 'kc_token';
+  static const _refreshKey = 'kc_refresh';
 
   Identity? _identity;
   Identity? get identity => _identity;
   bool _loading = true;
   bool get loading => _loading;
   bool get isLoggedIn => _identity != null;
+  String? _authError;
+  String? get authError => _authError;
 
   Api get api => _api;
 
   Future<void> bootstrap() async {
     final prefs = await SharedPreferences.getInstance();
+
+    // 1. Are we landing on the OIDC redirect (?code=…)?
+    try {
+      final tokens = await _oidc.completeIfCallback();
+      if (tokens != null) {
+        await _establish(tokens.accessToken, refreshToken: tokens.refreshToken);
+        _loading = false;
+        notifyListeners();
+        return;
+      }
+    } catch (e) {
+      _authError = '$e';
+    }
+
+    // 2. Restore a stored session, refreshing an expired Authentik token.
     final saved = prefs.getString(_tokenKey);
     if (saved != null) {
       _api.token = saved;
       try {
         _identity = await _api.me();
       } catch (_) {
-        _api.token = null;
-        await prefs.remove(_tokenKey);
+        final refresh = prefs.getString(_refreshKey);
+        if (refresh != null) {
+          try {
+            final t = await _oidc.refresh(refresh);
+            await _establish(t.accessToken, refreshToken: t.refreshToken ?? refresh);
+          } catch (_) {
+            await _clear(prefs);
+          }
+        } else {
+          await _clear(prefs);
+        }
       }
     }
     _loading = false;
     notifyListeners();
   }
 
-  Future<void> _establish(String token) async {
+  Future<void> beginOidcLogin() => _oidc.beginLogin();
+
+  Future<void> _establish(String token, {String? refreshToken}) async {
     _api.token = token;
     _identity = await _api.me();
     final prefs = await SharedPreferences.getInstance();
     await prefs.setString(_tokenKey, token);
+    if (refreshToken != null) {
+      await prefs.setString(_refreshKey, refreshToken);
+    }
+    _authError = null;
     notifyListeners();
   }
 
+  Future<void> _clear(SharedPreferences prefs) async {
+    _api.token = null;
+    await prefs.remove(_tokenKey);
+    await prefs.remove(_refreshKey);
+  }
+
   Future<void> guestLogin(String code, String first, String last) =>
       _api.guestLogin(code, first, last).then(_establish);
 
@@ -402,10 +518,9 @@ class AppState extends ChangeNotifier {
           .then(_establish);
 
   Future<void> logout() async {
-    _api.token = null;
     _identity = null;
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.remove(_tokenKey);
+    _authError = null;
+    await _clear(await SharedPreferences.getInstance());
     notifyListeners();
   }
 }

client/app/lib/browser.dart

@@ -0,0 +1,3 @@
+// Picks the real browser implementation on web, a throwing stub elsewhere
+// (so `flutter test` on the Dart VM still compiles).
+export 'browser_stub.dart' if (dart.library.js_interop) 'browser_web.dart';

client/app/lib/browser_stub.dart

@@ -0,0 +1,9 @@
+// Non-web fallback: the OIDC redirect flow only runs in a browser.
+const _msg = 'Browser-only: OIDC login is not available on this platform.';
+
+void setSession(String key, String value) => throw UnsupportedError(_msg);
+String? getSession(String key) => throw UnsupportedError(_msg);
+void removeSession(String key) => throw UnsupportedError(_msg);
+Never redirect(String url) => throw UnsupportedError(_msg);
+Map<String, String> currentQueryParameters() => const {};
+void clearQuery() {}

client/app/lib/browser_web.dart

@@ -0,0 +1,22 @@
+import 'package:web/web.dart' as web;
+
+/// Per-tab storage for the PKCE verifier + CSRF state (cleared when the tab
+/// closes), and the little bit of `window` access the OIDC redirect needs.
+
+void setSession(String key, String value) =>
+    web.window.sessionStorage.setItem(key, value);
+
+String? getSession(String key) => web.window.sessionStorage.getItem(key);
+
+void removeSession(String key) => web.window.sessionStorage.removeItem(key);
+
+void redirect(String url) => web.window.location.assign(url);
+
+Map<String, String> currentQueryParameters() =>
+    Uri.parse(web.window.location.href).queryParameters;
+
+/// Drop the OIDC callback path + `?code=…&state=…` from the address bar
+/// without reloading (back to the app root).
+void clearQuery() {
+  web.window.history.replaceState(null, '', '/');
+}

client/app/lib/oidc.dart

@@ -0,0 +1,151 @@
+import 'dart:convert';
+import 'dart:math';
+
+import 'package:crypto/crypto.dart';
+import 'package:http/http.dart' as http;
+
+import 'browser.dart' as browser;
+
+/// Authentik OIDC config. Overridable with --dart-define; defaults are the
+/// konfi-castle production values (a *public* client — PKCE, no secret).
+const kOidcIssuer = String.fromEnvironment(
+  'OIDC_ISSUER',
+  defaultValue: 'https://sso.konfi-castle.com/application/o/konfi-castle-app/',
+);
+const kOidcClientId = String.fromEnvironment(
+  'OIDC_CLIENT_ID',
+  defaultValue: 'K7f9mn6bP6jSjZDMYuiZCXMeVmVcqFcYNj0blJk9',
+);
+const kOidcRedirectUri = String.fromEnvironment(
+  'OIDC_REDIRECT_URI',
+  defaultValue: 'http://localhost:3000/v1/auth/callback',
+);
+
+const _scope = 'openid profile email groups offline_access';
+const _verifierKey = 'oidc_verifier';
+const _stateKey = 'oidc_state';
+
+class OidcTokens {
+  OidcTokens({required this.accessToken, this.refreshToken, this.expiresIn});
+  final String accessToken;
+  final String? refreshToken;
+  final int? expiresIn;
+
+  factory OidcTokens.fromJson(Map<String, dynamic> j) => OidcTokens(
+        accessToken: j['access_token'] as String,
+        refreshToken: j['refresh_token'] as String?,
+        expiresIn: (j['expires_in'] as num?)?.toInt(),
+      );
+}
+
+class OidcException implements Exception {
+  OidcException(this.message);
+  final String message;
+  @override
+  String toString() => 'OidcException: $message';
+}
+
+/// Authorization-Code + PKCE against Authentik, for the browser. The backend
+/// only validates the resulting access token (resource-server pattern).
+class OidcClient {
+  OidcClient(this._http);
+  final http.Client _http;
+  Map<String, dynamic>? _discovery;
+
+  Future<Map<String, dynamic>> _disc() async {
+    if (_discovery != null) return _discovery!;
+    final base = kOidcIssuer.endsWith('/') ? kOidcIssuer : '$kOidcIssuer/';
+    final res = await _http.get(Uri.parse('$base.well-known/openid-configuration'));
+    if (res.statusCode != 200) {
+      throw OidcException('Discovery failed (${res.statusCode})');
+    }
+    return _discovery = jsonDecode(res.body) as Map<String, dynamic>;
+  }
+
+  /// Kicks off the redirect to Authentik. Does not return (page navigates).
+  Future<void> beginLogin() async {
+    final d = await _disc();
+    final verifier = _randomUrlToken(64);
+    final state = _randomUrlToken(24);
+    final challenge = base64UrlEncode(sha256.convert(ascii.encode(verifier)).bytes)
+        .replaceAll('=', '');
+    browser.setSession(_verifierKey, verifier);
+    browser.setSession(_stateKey, state);
+
+    final authUri = Uri.parse(d['authorization_endpoint'] as String).replace(
+      queryParameters: {
+        'response_type': 'code',
+        'client_id': kOidcClientId,
+        'redirect_uri': kOidcRedirectUri,
+        'scope': _scope,
+        'state': state,
+        'code_challenge': challenge,
+        'code_challenge_method': 'S256',
+      },
+    );
+    browser.redirect(authUri.toString());
+  }
+
+  /// If the current URL carries `?code=…`, exchanges it for tokens and scrubs
+  /// the query. Returns null when this isn't a callback load.
+  Future<OidcTokens?> completeIfCallback() async {
+    final params = browser.currentQueryParameters();
+    final code = params['code'];
+    if (code == null || code.isEmpty) {
+      if (params['error'] != null) {
+        browser.clearQuery();
+        throw OidcException('Authentik: ${params['error_description'] ?? params['error']}');
+      }
+      return null;
+    }
+    final expectedState = browser.getSession(_stateKey);
+    final verifier = browser.getSession(_verifierKey);
+    browser.removeSession(_stateKey);
+    browser.removeSession(_verifierKey);
+    browser.clearQuery();
+
+    if (verifier == null || params['state'] != expectedState) {
+      throw OidcException('State mismatch — please retry the login.');
+    }
+    final d = await _disc();
+    final res = await _http.post(
+      Uri.parse(d['token_endpoint'] as String),
+      headers: {'Content-Type': 'application/x-www-form-urlencoded'},
+      body: {
+        'grant_type': 'authorization_code',
+        'code': code,
+        'redirect_uri': kOidcRedirectUri,
+        'client_id': kOidcClientId,
+        'code_verifier': verifier,
+      },
+    );
+    if (res.statusCode != 200) {
+      throw OidcException('Token exchange failed (${res.statusCode}): ${res.body}');
+    }
+    return OidcTokens.fromJson(jsonDecode(res.body) as Map<String, dynamic>);
+  }
+
+  Future<OidcTokens> refresh(String refreshToken) async {
+    final d = await _disc();
+    final res = await _http.post(
+      Uri.parse(d['token_endpoint'] as String),
+      headers: {'Content-Type': 'application/x-www-form-urlencoded'},
+      body: {
+        'grant_type': 'refresh_token',
+        'refresh_token': refreshToken,
+        'client_id': kOidcClientId,
+      },
+    );
+    if (res.statusCode != 200) {
+      throw OidcException('Refresh failed (${res.statusCode})');
+    }
+    return OidcTokens.fromJson(jsonDecode(res.body) as Map<String, dynamic>);
+  }
+
+  static String _randomUrlToken(int length) {
+    const chars =
+        'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+    final rnd = Random.secure();
+    return List.generate(length, (_) => chars[rnd.nextInt(chars.length)]).join();
+  }
+}

client/app/lib/screens/admin_screen.dart

@@ -0,0 +1,291 @@
+import 'package:flutter/material.dart';
+
+import '../api.dart';
+import '../main.dart';
+
+/// Leitungsteam admin: KCs, their Gemeinden, and pending self-registrations.
+class AdminScreen extends StatefulWidget {
+  const AdminScreen({super.key});
+
+  @override
+  State<AdminScreen> createState() => _AdminScreenState();
+}
+
+class _AdminScreenState extends State<AdminScreen> {
+  Future<List<Kc>>? _future;
+
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    _future ??= AppScope.of(context).api.kcs();
+  }
+
+  void _reload() => setState(() => _future = AppScope.of(context).api.kcs());
+
+  Future<void> _createKc() async {
+    final api = AppScope.of(context).api;
+    final name = await _promptText(context, 'Neues KC', 'Name');
+    if (name == null || name.isEmpty || !mounted) return;
+    try {
+      await api.createKc(name);
+      if (mounted) _reload();
+    } catch (e) {
+      if (mounted) _toast(context, '$e');
+    }
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(title: const Text('Verwaltung')),
+      floatingActionButton: FloatingActionButton.extended(
+        onPressed: _createKc,
+        icon: const Icon(Icons.add),
+        label: const Text('KC'),
+      ),
+      body: FutureBuilder<List<Kc>>(
+        future: _future,
+        builder: (context, snap) {
+          if (snap.connectionState != ConnectionState.done) {
+            return const Center(child: CircularProgressIndicator());
+          }
+          if (snap.hasError) {
+            return Center(
+              child: Padding(
+                padding: const EdgeInsets.all(24),
+                child: Text('${snap.error}', textAlign: TextAlign.center),
+              ),
+            );
+          }
+          final kcs = snap.data!;
+          if (kcs.isEmpty) {
+            return const Center(child: Text('Noch keine KCs. Unten anlegen.'));
+          }
+          return ListView(
+            children: [
+              for (final kc in kcs)
+                ListTile(
+                  leading: const Icon(Icons.festival),
+                  title: Text(kc.name),
+                  subtitle: Text('Code ${kc.inviteCode}'),
+                  trailing: const Icon(Icons.chevron_right),
+                  onTap: () => Navigator.of(context).push(
+                    MaterialPageRoute(builder: (_) => KcDetailScreen(kc: kc)),
+                  ),
+                ),
+            ],
+          );
+        },
+      ),
+    );
+  }
+}
+
+class KcDetailScreen extends StatefulWidget {
+  const KcDetailScreen({super.key, required this.kc});
+  final Kc kc;
+
+  @override
+  State<KcDetailScreen> createState() => _KcDetailScreenState();
+}
+
+class _KcDetailScreenState extends State<KcDetailScreen> {
+  Future<List<Gemeinde>>? _gemeinden;
+  Future<List<OnboardingRequest>>? _requests;
+
+  Api get _api => AppScope.of(context).api;
+
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    _gemeinden ??= _api.gemeinden(widget.kc.id);
+    _requests ??= _api.onboardingRequests(widget.kc.id);
+  }
+
+  void _reloadGemeinden() =>
+      setState(() => _gemeinden = _api.gemeinden(widget.kc.id));
+  void _reloadRequests() =>
+      setState(() => _requests = _api.onboardingRequests(widget.kc.id));
+
+  Future<void> _addGemeinde() async {
+    final api = _api;
+    final name = await _promptText(context, 'Neue Gemeinde', 'Name');
+    if (name == null || name.isEmpty || !mounted) return;
+    try {
+      await api.createGemeinde(widget.kc.id, name);
+      if (mounted) _reloadGemeinden();
+    } catch (e) {
+      if (mounted) _toast(context, '$e');
+    }
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(title: Text(widget.kc.name)),
+      body: ListView(
+        padding: const EdgeInsets.all(16),
+        children: [
+          Card(
+            child: ListTile(
+              title: const Text('Einladungscode'),
+              subtitle: Text(widget.kc.inviteCode),
+              trailing: const Icon(Icons.qr_code_2),
+            ),
+          ),
+          const SizedBox(height: 16),
+          Row(
+            children: [
+              Expanded(
+                child: Text('Gemeinden',
+                    style: Theme.of(context).textTheme.titleMedium),
+              ),
+              TextButton.icon(
+                onPressed: _addGemeinde,
+                icon: const Icon(Icons.add),
+                label: const Text('Hinzufügen'),
+              ),
+            ],
+          ),
+          _GemeindeList(future: _gemeinden!, onRetry: _reloadGemeinden),
+          const Divider(height: 40),
+          Text('Offene Verantwortlichen-Anfragen',
+              style: Theme.of(context).textTheme.titleMedium),
+          const SizedBox(height: 8),
+          _RequestList(
+            future: _requests!,
+            onAction: (id, approve) async {
+              try {
+                approve
+                    ? await _api.approveOnboarding(id)
+                    : await _api.rejectOnboarding(id);
+                _reloadRequests();
+              } catch (e) {
+                if (context.mounted) _toast(context, '$e');
+              }
+            },
+          ),
+        ],
+      ),
+    );
+  }
+}
+
+class _GemeindeList extends StatelessWidget {
+  const _GemeindeList({required this.future, required this.onRetry});
+  final Future<List<Gemeinde>> future;
+  final VoidCallback onRetry;
+
+  @override
+  Widget build(BuildContext context) {
+    return FutureBuilder<List<Gemeinde>>(
+      future: future,
+      builder: (context, snap) {
+        if (snap.connectionState != ConnectionState.done) {
+          return const Padding(
+            padding: EdgeInsets.all(12),
+            child: Center(child: CircularProgressIndicator()),
+          );
+        }
+        if (snap.hasError) {
+          return TextButton(onPressed: onRetry, child: Text('Fehler: ${snap.error}'));
+        }
+        final gemeinden = snap.data!;
+        if (gemeinden.isEmpty) return const Text('Noch keine Gemeinden.');
+        return Column(
+          children: [
+            for (final g in gemeinden)
+              ListTile(
+                dense: true,
+                leading: const Icon(Icons.church),
+                title: Text(g.name),
+              ),
+          ],
+        );
+      },
+    );
+  }
+}
+
+class _RequestList extends StatelessWidget {
+  const _RequestList({required this.future, required this.onAction});
+  final Future<List<OnboardingRequest>> future;
+  final Future<void> Function(String id, bool approve) onAction;
+
+  @override
+  Widget build(BuildContext context) {
+    return FutureBuilder<List<OnboardingRequest>>(
+      future: future,
+      builder: (context, snap) {
+        if (snap.connectionState != ConnectionState.done) {
+          return const Padding(
+            padding: EdgeInsets.all(12),
+            child: Center(child: CircularProgressIndicator()),
+          );
+        }
+        if (snap.hasError) {
+          return Text('Fehler: ${snap.error}');
+        }
+        final requests = snap.data!;
+        if (requests.isEmpty) return const Text('Keine offenen Anfragen.');
+        return Column(
+          children: [
+            for (final r in requests)
+              Card(
+                child: ListTile(
+                  title: Text(r.userName.isEmpty ? r.userEmail : r.userName),
+                  subtitle: Text('${r.userEmail}\nGemeinde: ${r.gemeindeName}'),
+                  isThreeLine: true,
+                  trailing: Row(
+                    mainAxisSize: MainAxisSize.min,
+                    children: [
+                      IconButton(
+                        tooltip: 'Genehmigen',
+                        icon: const Icon(Icons.check, color: Colors.green),
+                        onPressed: () => onAction(r.id, true),
+                      ),
+                      IconButton(
+                        tooltip: 'Ablehnen',
+                        icon: const Icon(Icons.close, color: Colors.red),
+                        onPressed: () => onAction(r.id, false),
+                      ),
+                    ],
+                  ),
+                ),
+              ),
+          ],
+        );
+      },
+    );
+  }
+}
+
+Future<String?> _promptText(BuildContext context, String title, String label) {
+  final controller = TextEditingController();
+  return showDialog<String>(
+    context: context,
+    builder: (context) => AlertDialog(
+      title: Text(title),
+      content: TextField(
+        controller: controller,
+        autofocus: true,
+        decoration: InputDecoration(labelText: label),
+        onSubmitted: (v) => Navigator.of(context).pop(v.trim()),
+      ),
+      actions: [
+        TextButton(
+          onPressed: () => Navigator.of(context).pop(),
+          child: const Text('Abbrechen'),
+        ),
+        FilledButton(
+          onPressed: () => Navigator.of(context).pop(controller.text.trim()),
+          child: const Text('OK'),
+        ),
+      ],
+    ),
+  );
+}
+
+void _toast(BuildContext context, String message) {
+  ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text(message)));
+}

client/app/lib/screens/home_screen.dart

@@ -2,6 +2,7 @@ import 'package:flutter/material.dart';
 
 import '../api.dart';
 import '../main.dart';
+import 'admin_screen.dart';
 import 'chat_screen.dart';
 import 'files_screen.dart';
 import 'wahl_screen.dart';
@@ -16,6 +17,13 @@ class HomeScreen extends StatelessWidget {
     final kcId = id.kcId;
 
     final tiles = <Widget>[
+      if (id.isLeitungsteam)
+        _NavTile(
+          icon: Icons.admin_panel_settings,
+          title: 'Verwaltung',
+          subtitle: 'KCs, Gemeinden, Onboarding-Freigaben',
+          onTap: () => _open(context, const AdminScreen()),
+        ),
       if (id.kind == SessionKind.guest)
         _NavTile(
           icon: Icons.how_to_vote,

client/app/lib/screens/login_screen.dart

@@ -79,8 +79,10 @@ class _FormShellState extends State<_FormShell> {
     return ListView(
       shrinkWrap: true,
       children: [
-        Text(widget.title, style: Theme.of(context).textTheme.titleLarge),
-        const SizedBox(height: 16),
+        if (widget.title.isNotEmpty) ...[
+          Text(widget.title, style: Theme.of(context).textTheme.titleLarge),
+          const SizedBox(height: 16),
+        ],
         ...widget.fields,
         const SizedBox(height: 20),
         if (_error != null) ...[
@@ -146,21 +148,54 @@ class _TeamFormState extends State<_TeamForm> {
   @override
   Widget build(BuildContext context) {
     final state = AppScope.of(context);
-    return _FormShell(
-      title: 'Teamer:in-Login',
-      fields: [
-        _field(_email, 'E-Mail'),
+    return ListView(
+      shrinkWrap: true,
+      children: [
+        Text('Leitungsteam / Verantwortliche',
+            style: Theme.of(context).textTheme.titleLarge),
         const SizedBox(height: 12),
-        _field(_password, 'Passwort', obscure: true),
+        if (state.authError != null) ...[
+          Text(state.authError!,
+              style: TextStyle(color: Theme.of(context).colorScheme.error)),
+          const SizedBox(height: 12),
+        ],
+        FilledButton.icon(
+          onPressed: () => state.beginOidcLogin(),
+          icon: const Icon(Icons.login),
+          label: const Text('Mit Konfi-Castle-ID anmelden'),
+        ),
         const SizedBox(height: 8),
         const Text(
-          'Leitungsteam & Gemeinde-Verantwortliche melden sich über die '
-          'Konfi-Castle-ID (Authentik) an — dieser Client deckt bisher den '
-          'lokalen Teamer-Login ab.',
+          'Öffnet die Konfi-Castle-ID (Authentik). Leitungsteam-Rechte kommen '
+          'aus deiner Authentik-Gruppe.',
           style: TextStyle(fontSize: 12),
         ),
+        const Divider(height: 40),
+        Text('Lokaler Teamer:in-Login',
+            style: Theme.of(context).textTheme.titleMedium),
+        const SizedBox(height: 12),
+        _TeamPasswordForm(email: _email, password: _password),
       ],
-      onSubmit: () => state.teamLogin(_email.text.trim(), _password.text),
+    );
+  }
+}
+
+class _TeamPasswordForm extends StatelessWidget {
+  const _TeamPasswordForm({required this.email, required this.password});
+  final TextEditingController email;
+  final TextEditingController password;
+
+  @override
+  Widget build(BuildContext context) {
+    final state = AppScope.of(context);
+    return _FormShell(
+      title: '',
+      fields: [
+        _field(email, 'E-Mail'),
+        const SizedBox(height: 12),
+        _field(password, 'Passwort', obscure: true),
+      ],
+      onSubmit: () => state.teamLogin(email.text.trim(), password.text),
     );
   }
 }