feat(backend): multi-tenant refactor + Geraete + Kundenbilder

Middleware:
- requireTenant prueft tenant_id, Status und Demo-Ablauf (autom. Status-Update)
- requireSuperAdmin fuer cross-tenant Endpoints
- JWT enthaelt jetzt tenant_id

Auth:
- Login: SuperAdmin (tenant_id=NULL) ODER tenant-scoped User
- Demo-Ablaufs-Check beim Login

Neue Routes:
- /api/tenants  (SuperAdmin: Demo-Accounts anlegen mit 30-Tage-Default,
                 Mail-Invite via Resend, Sample-Daten-Seed automatisch,
                 verlaengern, deaktivieren)
- /api/geraete  (Seriennummern-Verwaltung mit Kunde-Zuordnung)
- /api/kunden-bilder/:kunde_id (Foto-Upload, max 5/Kunde)

Bestehende Routes:
- alle tenant_id-scoped (SELECT/UPDATE/DELETE)
- kunden: anlieferungshinweis + lieferzeit_bis Felder
- Cross-tenant-Refs (kunde_id/artikel_id) werden gegen Tenant validiert

Lib:
- lib/mail.js (Resend, mit Dev-Fallback)
- lib/seed.js (5 Kunden, 3 Artikel, 6 Lieferungen, 2 Geraete)
- scripts/bootstrap.js (legt SuperAdmin aus env-Vars beim Start an)

server.js: neue Routes + bootstrap-Call

backend/routes/tenants.js

@@ -0,0 +1,140 @@
+import express from 'express';
+import bcrypt from 'bcrypt';
+import { body, validationResult } from 'express-validator';
+import crypto from 'crypto';
+import pool from '../config/database.js';
+import { authenticateToken, requireSuperAdmin } from '../middleware/auth.js';
+import { sendDemoInviteMail } from '../lib/mail.js';
+import { seedDemoTenant } from '../lib/seed.js';
+
+const router = express.Router();
+router.use(authenticateToken, requireSuperAdmin);
+
+// GET /api/tenants
+router.get('/', async (req, res) => {
+  try {
+    const [rows] = await pool.query(
+      `SELECT t.*,
+              (SELECT COUNT(*) FROM mitarbeiter WHERE tenant_id = t.id) AS user_count,
+              (SELECT COUNT(*) FROM kunden WHERE tenant_id = t.id) AS kunden_count
+       FROM tenants t
+       ORDER BY t.erstellt_am DESC`
+    );
+    res.json(rows);
+  } catch (e) {
+    console.error('GET tenants:', e);
+    res.status(500).json({ error: 'Serverfehler' });
+  }
+});
+
+// GET /api/tenants/:id
+router.get('/:id', async (req, res) => {
+  try {
+    const [rows] = await pool.query('SELECT * FROM tenants WHERE id = ?', [req.params.id]);
+    if (rows.length === 0) return res.status(404).json({ error: 'Tenant nicht gefunden' });
+    res.json(rows[0]);
+  } catch (e) {
+    res.status(500).json({ error: 'Serverfehler' });
+  }
+});
+
+// POST /api/tenants  -> legt Demo-Tenant + Admin-User + Sample-Daten an, schickt Invite-Mail
+// body: { name, kontakt_email, firma?, days? (default 30), seed? (default true) }
+router.post('/', [
+  body('name').notEmpty().trim(),
+  body('kontakt_email').isEmail().normalizeEmail(),
+  body('days').optional().isInt({ min: 1, max: 365 })
+], async (req, res) => {
+  const errors = validationResult(req);
+  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
+
+  const { name, kontakt_email, firma, days = 30, seed = true } = req.body;
+  const slug = (firma || name).toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 50)
+    + '-' + crypto.randomBytes(2).toString('hex');
+
+  const conn = await pool.getConnection();
+  try {
+    await conn.beginTransaction();
+
+    // tenant
+    const tenantId = crypto.randomUUID();
+    await conn.query(
+      `INSERT INTO tenants (id, name, slug, kontakt_email, firma, typ, status, demo_expires_at, max_users)
+       VALUES (?, ?, ?, ?, ?, 'demo', 'aktiv', DATE_ADD(NOW(), INTERVAL ? DAY), 5)`,
+      [tenantId, name, slug, kontakt_email, firma || null, days]
+    );
+
+    // admin user
+    const adminId = crypto.randomUUID();
+    const plainPw = crypto.randomBytes(8).toString('base64url');
+    const hash = await bcrypt.hash(plainPw, 10);
+    await conn.query(
+      `INSERT INTO mitarbeiter (id, tenant_id, email, password_hash, name, rolle, aktiv)
+       VALUES (?, ?, ?, ?, ?, 'admin', 1)`,
+      [adminId, tenantId, kontakt_email, hash, name]
+    );
+
+    if (seed) await seedDemoTenant(conn, tenantId);
+
+    await conn.commit();
+
+    // Mail asynchron - Fehler nicht blockend
+    sendDemoInviteMail({
+      to: kontakt_email, name, slug, password: plainPw,
+      loginUrl: `https://pfandsystem.dockly.de/login?tenant=${slug}`,
+      days
+    }).catch(err => console.error('Mail-Fehler:', err.message));
+
+    res.status(201).json({
+      tenant_id: tenantId, slug,
+      admin_email: kontakt_email,
+      // Passwort wird ausnahmsweise im Response zurueckgegeben, damit der SuperAdmin
+      // es ggf. manuell weitergeben kann, falls die Mail nicht ankommt.
+      admin_password_oneshot: plainPw,
+      demo_expires_in_days: days
+    });
+  } catch (e) {
+    await conn.rollback();
+    console.error('Tenant-Anlage-Fehler:', e);
+    res.status(500).json({ error: 'Fehler beim Anlegen des Tenants', detail: e.message });
+  } finally {
+    conn.release();
+  }
+});
+
+// PATCH /api/tenants/:id  -> Demo verlaengern, Status aendern, Limits aendern
+router.patch('/:id', async (req, res) => {
+  const updates = [];
+  const values = [];
+  if (req.body.extend_days) {
+    updates.push('demo_expires_at = DATE_ADD(COALESCE(demo_expires_at, NOW()), INTERVAL ? DAY)');
+    values.push(parseInt(req.body.extend_days));
+    updates.push("status = 'aktiv'");
+  }
+  if (req.body.status) { updates.push('status = ?'); values.push(req.body.status); }
+  if (req.body.max_users) { updates.push('max_users = ?'); values.push(parseInt(req.body.max_users)); }
+  if (req.body.typ) { updates.push('typ = ?'); values.push(req.body.typ); }
+  if (updates.length === 0) return res.status(400).json({ error: 'Keine Aenderungen' });
+  values.push(req.params.id);
+  try {
+    await pool.query(`UPDATE tenants SET ${updates.join(', ')} WHERE id = ?`, values);
+    const [rows] = await pool.query('SELECT * FROM tenants WHERE id = ?', [req.params.id]);
+    res.json(rows[0]);
+  } catch (e) {
+    console.error('Tenant-Update:', e);
+    res.status(500).json({ error: 'Serverfehler' });
+  }
+});
+
+// DELETE /api/tenants/:id  -> Tenant inkl. aller Daten loeschen (CASCADE)
+router.delete('/:id', async (req, res) => {
+  try {
+    await pool.query('DELETE FROM tenants WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Tenant geloescht' });
+  } catch (e) {
+    res.status(500).json({ error: 'Serverfehler' });
+  }
+});
+
+export default router;