M0: Skelett + Auth-Grundgerüst (Keycloak-OIDC + API-Token)

- Symfony 7.4 LTS, PHP 8.4, FrankenPHP, SQLite (3-Layer src/UI|Logic|Data)
- Auth: manueller OidcClient (Authorization-Code) im UI-Layer, kein
  Security-Bundle/league; Session-Gate via SessionAuthSubscriber
- API-Guard via statischem X-Api-Token (ApiTokenSubscriber); ExceptionSubscriber
- UserEntity (Auto-Provision) + Init-Migration
- Docker (php:8.4-frankenphp) + compose (essen.ljh31.de, traefik-net external)
- SmokeTests (7) grün: Redirect-Fälle, API-Token, Auth-Render, Logout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Doku/plan.md

@@ -20,11 +20,12 @@ Status: **final** (2026-09-13, abgestimmt) · Basis: [`anforderungen.md`](anford
 
 ### M0 – Skelett + Auth-Grundgerüst
 - Symfony 7.4 LTS, PHP 8.4, FrankenPHP: `composer.json`, `config/`
-  (framework, security, doctrine/SQLite, twig, routing), `public/index.php`
+  (framework, doctrine/SQLite, twig, routing), `public/index.php`
 - Struktur laut `architektur.md` leergelegt (`src/UI`, `src/Logic`, `src/Data`)
-- Keycloak-OIDC: `league/oauth2-client`, `security.yaml`,
-  Login/Logout auf Keycloak, `REMOTE_USER`-Claim → lokale User-Zeile (Auto-Provision)
-- Docker: `Dockerfile` (php:8.4-frankenphp), `docker-compose.yaml`
+- Keycloak-OIDC: manueller `OidcClient` (kein `league/oauth2-client`, kein
+  Security-Bundle; vgl. ADR-003), Login/Callback/Logout im UI-Layer,
+  `sub`/`email`-Claim → lokale User-Zeile (Auto-Provision)
+- Docker: `Dockerfile` (php:8.4-frankenphp), `compose.yaml`
   (Volume `data/` für SQLite, `.env`), Network `infra-traefik_traefik-net` (external),
   Traefik-Labels → `essen.ljh31.de` + ACME + redirect-to-https
 - `phpunit.xml`, `tests/`, htmx + SortableJS in `public/js/`