M0: Skelett + Auth-Grundgerüst (Keycloak-OIDC + API-Token)

- Symfony 7.4 LTS, PHP 8.4, FrankenPHP, SQLite (3-Layer src/UI|Logic|Data)
- Auth: manueller OidcClient (Authorization-Code) im UI-Layer, kein
  Security-Bundle/league; Session-Gate via SessionAuthSubscriber
- API-Guard via statischem X-Api-Token (ApiTokenSubscriber); ExceptionSubscriber
- UserEntity (Auto-Provision) + Init-Migration
- Docker (php:8.4-frankenphp) + compose (essen.ljh31.de, traefik-net external)
- SmokeTests (7) grün: Redirect-Fälle, API-Token, Auth-Render, Logout

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Data/Infrastructure/Doctrine/EntityManagerTransactionManager.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Data\Infrastructure\Doctrine;
+
+use App\Logic\Common\TransactionManagerInterface;
+use Doctrine\ORM\EntityManagerInterface;
+
+/**
+ * Bridge von Doctrine\EntityManager auf `TransactionManagerInterface`.
+ *
+ * Verwendet Doctrine 3 `doInTransaction()` (commit + rollback).
+ */
+final class EntityManagerTransactionManager implements TransactionManagerInterface
+{
+    public function __construct(
+        private readonly EntityManagerInterface $em,
+    ) {
+    }
+
+    public function execute(\Closure $work): mixed
+    {
+        try {
+            return $this->em->transactional(static fn () => $work($work));
+        } catch (\Throwable $e) {
+            $this->em->clear();
+            throw $e;
+        }
+    }
+}