feat(backend): multi-tenant refactor + Geraete + Kundenbilder

Middleware:
- requireTenant prueft tenant_id, Status und Demo-Ablauf (autom. Status-Update)
- requireSuperAdmin fuer cross-tenant Endpoints
- JWT enthaelt jetzt tenant_id

Auth:
- Login: SuperAdmin (tenant_id=NULL) ODER tenant-scoped User
- Demo-Ablaufs-Check beim Login

Neue Routes:
- /api/tenants  (SuperAdmin: Demo-Accounts anlegen mit 30-Tage-Default,
                 Mail-Invite via Resend, Sample-Daten-Seed automatisch,
                 verlaengern, deaktivieren)
- /api/geraete  (Seriennummern-Verwaltung mit Kunde-Zuordnung)
- /api/kunden-bilder/:kunde_id (Foto-Upload, max 5/Kunde)

Bestehende Routes:
- alle tenant_id-scoped (SELECT/UPDATE/DELETE)
- kunden: anlieferungshinweis + lieferzeit_bis Felder
- Cross-tenant-Refs (kunde_id/artikel_id) werden gegen Tenant validiert

Lib:
- lib/mail.js (Resend, mit Dev-Fallback)
- lib/seed.js (5 Kunden, 3 Artikel, 6 Lieferungen, 2 Geraete)
- scripts/bootstrap.js (legt SuperAdmin aus env-Vars beim Start an)

server.js: neue Routes + bootstrap-Call

backend/routes/kunden-bilder.js

@@ -0,0 +1,84 @@
+import express from 'express';
+import fs from 'fs';
+import path from 'path';
+import pool from '../config/database.js';
+import { authenticateToken, requireTenant } from '../middleware/auth.js';
+import { upload } from '../middleware/upload.js';
+
+const router = express.Router();
+router.use(authenticateToken, requireTenant);
+
+// POST /api/kunden-bilder/:kunde_id  (Multipart, Feld: foto)
+router.post('/:kunde_id', upload.single('foto'), async (req, res) => {
+  if (!req.file) return res.status(400).json({ error: 'Kein Bild hochgeladen' });
+  try {
+    const [[k]] = await pool.query('SELECT id FROM kunden WHERE id=? AND tenant_id=?',
+                                   [req.params.kunde_id, req.user.tenant_id]);
+    if (!k) {
+      // Datei aufraeumen
+      try { fs.unlinkSync(req.file.path); } catch {}
+      return res.status(404).json({ error: 'Kunde nicht gefunden' });
+    }
+    const [[c]] = await pool.query(
+      'SELECT COUNT(*) AS n FROM kunden_bilder WHERE kunde_id = ? AND tenant_id = ?',
+      [req.params.kunde_id, req.user.tenant_id]
+    );
+    if (c.n >= 5) {
+      try { fs.unlinkSync(req.file.path); } catch {}
+      return res.status(400).json({ error: 'Max. 5 Bilder pro Kunde' });
+    }
+    await pool.query(
+      `INSERT INTO kunden_bilder (id, tenant_id, kunde_id, dateiname, beschreibung, sortierung)
+       VALUES (UUID(), ?, ?, ?, ?, ?)`,
+      [req.user.tenant_id, req.params.kunde_id, `/uploads/${req.file.filename}`,
+       req.body.beschreibung || null, parseInt(req.body.sortierung) || c.n]
+    );
+    const [rows] = await pool.query(
+      `SELECT * FROM kunden_bilder WHERE kunde_id = ? AND tenant_id = ?
+       ORDER BY sortierung, erstellt_am`,
+      [req.params.kunde_id, req.user.tenant_id]
+    );
+    res.status(201).json(rows);
+  } catch (e) {
+    console.error('POST kunden-bilder:', e);
+    res.status(500).json({ error: 'Serverfehler' });
+  }
+});
+
+// PATCH /api/kunden-bilder/:id  -> beschreibung / sortierung
+router.patch('/bild/:id', async (req, res) => {
+  const updates = [];
+  const values = [];
+  if (req.body.beschreibung !== undefined) { updates.push('beschreibung = ?'); values.push(req.body.beschreibung); }
+  if (req.body.sortierung !== undefined) { updates.push('sortierung = ?'); values.push(parseInt(req.body.sortierung)); }
+  if (updates.length === 0) return res.status(400).json({ error: 'Keine Aenderungen' });
+  values.push(req.params.id, req.user.tenant_id);
+  try {
+    const [r] = await pool.query(
+      `UPDATE kunden_bilder SET ${updates.join(', ')} WHERE id = ? AND tenant_id = ?`,
+      values
+    );
+    if (r.affectedRows === 0) return res.status(404).json({ error: 'Bild nicht gefunden' });
+    res.json({ message: 'Aktualisiert' });
+  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
+});
+
+// DELETE /api/kunden-bilder/bild/:id
+router.delete('/bild/:id', async (req, res) => {
+  try {
+    const [rows] = await pool.query(
+      'SELECT dateiname FROM kunden_bilder WHERE id = ? AND tenant_id = ?',
+      [req.params.id, req.user.tenant_id]
+    );
+    if (rows.length === 0) return res.status(404).json({ error: 'Bild nicht gefunden' });
+    await pool.query('DELETE FROM kunden_bilder WHERE id = ? AND tenant_id = ?',
+                     [req.params.id, req.user.tenant_id]);
+    // Datei loeschen (best effort)
+    const filename = rows[0].dateiname.replace(/^\/uploads\//, '');
+    const fullPath = path.join(process.env.UPLOAD_DIR || '/app/uploads', filename);
+    try { fs.unlinkSync(fullPath); } catch {}
+    res.json({ message: 'Bild geloescht' });
+  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
+});
+
+export default router;