M0: Skelett + Auth-Grundgerüst (Keycloak-OIDC + API-Token)

- Symfony 7.4 LTS, PHP 8.4, FrankenPHP, SQLite (3-Layer src/UI|Logic|Data)
- Auth: manueller OidcClient (Authorization-Code) im UI-Layer, kein
  Security-Bundle/league; Session-Gate via SessionAuthSubscriber
- API-Guard via statischem X-Api-Token (ApiTokenSubscriber); ExceptionSubscriber
- UserEntity (Auto-Provision) + Init-Migration
- Docker (php:8.4-frankenphp) + compose (essen.ljh31.de, traefik-net external)
- SmokeTests (7) grün: Redirect-Fälle, API-Token, Auth-Render, Logout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose.yaml

@@ -0,0 +1,37 @@
+services:
+  app:
+    build: .
+    container_name: svc-essensplanung
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      APP_ENV: prod
+      APP_DEBUG: '0'
+      DATABASE_URL: sqlite:////data/essens.db
+    volumes:
+      - essens_data:/data
+      - essens_var:/app/var
+    healthcheck:
+      test: ['CMD', 'php', '-r', '$c=@fsockopen("127.0.0.1",8787); exit($c?0:1);']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - infra-traefik_traefik-net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.essens.rule=Host(`essen.ljh31.de`)"
+      - "traefik.http.routers.essens.entrypoints=websecure"
+      - "traefik.http.routers.essens.tls=true"
+      - "traefik.http.routers.essens.tls.certresolver=letsencrypt"
+      - "traefik.http.services.essens.loadbalancer.server.port=8787"
+
+volumes:
+  essens_data:
+  essens_var:
+
+networks:
+  infra-traefik_traefik-net:
+    external: true