feat(demo): Mail-Benachrichtigungen bei Demo-Ablauf

Neue Mail-Templates (lib/mail.js):
- sendDemoExpiryReminderMail: 7 Tage vor Ablauf
- sendDemoLastDayMail: 1 Tag vor Ablauf (Letzter-Tag-Reminder)
- sendDemoExpiredMail: am Ablauftag (setzt Tenant-Status abgelaufen)

Cron-Job (lib/expiryJob.js):
- node-cron taeglich 08:00 UTC (anpassbar via CRON_EXPIRY_AT)
- 3 Windows pruefen, idempotent ueber notified_*_at Timestamp-Spalten
- BETWEEN-Fenster [n-1, n] Tage fuer Robustheit

DB-Migration (bootstrap.js):
- Beim Backend-Start automatisches ALTER TABLE fuer
  notified_7d_at, notified_1d_at, notified_expired_at (idempotent)

Manueller Test: docker exec pfandsystem-demo-backend node -e "
  import(\"./lib/expiryJob.js\").then(m => m.runExpiryCheck())"

backend/scripts/bootstrap.js

@@ -1,25 +1,39 @@
 import bcrypt from 'bcrypt';
 import pool from '../config/database.js';
 
-// Stellt sicher dass mindestens ein SuperAdmin existiert.
-// Nutzt env SUPERADMIN_EMAIL + SUPERADMIN_PASSWORD beim ersten Start.
+const EXPIRY_COLS = ['notified_7d_at', 'notified_1d_at', 'notified_expired_at'];
+
+async function ensureExpiryColumns() {
+  const [cols] = await pool.query(
+    `SELECT COLUMN_NAME FROM information_schema.columns
+     WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'tenants'`
+  );
+  const have = new Set(cols.map(c => c.COLUMN_NAME));
+  for (const col of EXPIRY_COLS) {
+    if (!have.has(col)) {
+      await pool.query(`ALTER TABLE tenants ADD COLUMN ${col} TIMESTAMP NULL`);
+      console.log('[bootstrap] tenants ALTER ADD', col);
+    }
+  }
+}
+
 export async function bootstrapSuperAdmin() {
+  // Auf DB warten (max 30s)
+  for (let i = 0; i < 30; i++) {
+    try { await pool.query('SELECT 1'); break; }
+    catch { await new Promise(r => setTimeout(r, 1000)); }
+  }
+
+  // Migrations
+  try { await ensureExpiryColumns(); }
+  catch (e) { console.error('[bootstrap] Migration-Fehler:', e.message); }
+
   const email = process.env.SUPERADMIN_EMAIL;
   const password = process.env.SUPERADMIN_PASSWORD;
   if (!email || !password) {
     console.warn('[bootstrap] SUPERADMIN_EMAIL/PASSWORD nicht gesetzt - skip');
     return;
   }
-  // Auf Datenbank-Bereitschaft warten (max 30s)
-  for (let i = 0; i < 30; i++) {
-    try {
-      await pool.query('SELECT 1');
-      break;
-    } catch {
-      await new Promise(r => setTimeout(r, 1000));
-    }
-  }
-
   const [rows] = await pool.query(
     "SELECT id FROM mitarbeiter WHERE email = ? AND tenant_id IS NULL AND rolle = 'superadmin'",
     [email]