M0: Skelett + Auth-Grundgerüst (Keycloak-OIDC + API-Token)

- Symfony 7.4 LTS, PHP 8.4, FrankenPHP, SQLite (3-Layer src/UI|Logic|Data)
- Auth: manueller OidcClient (Authorization-Code) im UI-Layer, kein
  Security-Bundle/league; Session-Gate via SessionAuthSubscriber
- API-Guard via statischem X-Api-Token (ApiTokenSubscriber); ExceptionSubscriber
- UserEntity (Auto-Provision) + Init-Migration
- Docker (php:8.4-frankenphp) + compose (essen.ljh31.de, traefik-net external)
- SmokeTests (7) grün: Redirect-Fälle, API-Token, Auth-Render, Logout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/services.yaml

@@ -0,0 +1,36 @@
+# yaml-language-server: $schema=../vendor/symfony/dependency-injection/Loader/schema/services.schema.json
+
+parameters:
+    app.debug: '%kernel.debug%'
+    app.expected_api_token: '%env(API_TOKEN)%'
+
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+
+    App\:
+        resource: '../src/'
+        exclude:
+            - '../src/Kernel.php'
+
+    # Router-Controller automatisch als (getaggen) Service bekannt machen
+    App\UI\Http\:
+        resource: '../src/UI/Http/'
+        tags:
+            - { name: controller.service_arguments }
+
+    App\UI\Http\Auth\OidcClient:
+        arguments:
+            $issuer: '%env(string:KEYCLOAK_ISSUER)%'
+            $clientId: '%env(string:KEYCLOAK_CLIENT_ID)%'
+            $clientSecret: '%env(default::KEYCLOAK_CLIENT_SECRET)%'
+            $redirectUri: '%env(string:KEYCLOAK_REDIRECT_URI)%'
+
+    App\UI\Http\ExceptionSubscriber:
+        arguments:
+            $debug: '%app.debug%'
+
+    App\UI\Http\Api\ApiTokenSubscriber:
+        arguments:
+            $expectedToken: '%app.expected_api_token%'