Projekt-Fundament: Spec, Docker-Stack, Prisma-Basis, Tenant-Guard

- docs/SPEC.md (v1.2: Assets & BIA als ein Modul, Risiko-Detailansicht
  mit Maßnahmen/betroffenen Assets, Risiko-Verknüpfungen in allen
  Detailansichten) + UI-Mockup als Referenz
- Docker-Compose: app, worker, postgres (pgvector), redis, minio, mailhog
- Prisma 7: Fundament-Schema (Tenant, User, RBAC, AuditLog), prisma.config.ts,
  pg-Treiberadapter
- Tenant-Guard (src/server/db.ts): erzwungene Mandanten-Isolation für
  alle tenant-gebundenen Modelle
- AGENTS.md/README mit Projektregeln (Isolation, RBAC, Audit-Log, i18n, Lizenz)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,72 @@
+services:
+  app:
+    build: .
+    ports:
+      - "3000:3000"
+    env_file: .env
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+      minio:
+        condition: service_started
+    restart: unless-stopped
+
+  worker:
+    build: .
+    command: ["npm", "run", "worker"]
+    env_file: .env
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    restart: unless-stopped
+
+  postgres:
+    image: pgvector/pgvector:pg16
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-isms}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-isms}
+      POSTGRES_DB: ${POSTGRES_DB:-isms}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-isms}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  redis:
+    image: redis:7-alpine
+    volumes:
+      - redisdata:/data
+    ports:
+      - "6379:6379"
+
+  minio:
+    image: minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-isms}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-isms-secret}
+    volumes:
+      - miniodata:/data
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+
+  mailhog:
+    image: mailhog/mailhog:latest
+    profiles: ["dev"]
+    ports:
+      - "1025:1025"
+      - "8025:8025"
+
+volumes:
+  pgdata:
+  redisdata:
+  miniodata: