Projekt-Fundament: Spec, Docker-Stack, Prisma-Basis, Tenant-Guard

- docs/SPEC.md (v1.2: Assets & BIA als ein Modul, Risiko-Detailansicht
  mit Maßnahmen/betroffenen Assets, Risiko-Verknüpfungen in allen
  Detailansichten) + UI-Mockup als Referenz
- Docker-Compose: app, worker, postgres (pgvector), redis, minio, mailhog
- Prisma 7: Fundament-Schema (Tenant, User, RBAC, AuditLog), prisma.config.ts,
  pg-Treiberadapter
- Tenant-Guard (src/server/db.ts): erzwungene Mandanten-Isolation für
  alle tenant-gebundenen Modelle
- AGENTS.md/README mit Projektregeln (Isolation, RBAC, Audit-Log, i18n, Lizenz)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,23 @@
+# ISMS-Tool — Next.js App (Multi-Stage-Build)
+FROM node:22-alpine AS deps
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY prisma ./prisma
+RUN npm ci
+
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npx prisma generate && npm run build
+
+FROM node:22-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+RUN addgroup -S app && adduser -S app -G app
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+COPY --from=builder /app/public ./public
+USER app
+EXPOSE 3000
+CMD ["node", "server.js"]