Fundament: ISMS-Module entfernt; Craftvia-Rollen, Module, Navigation, i18n-Split

- ISMS-Routen, Actions, Server-/Lib-Code, Komponenten, Prisma-Modelle, Seeds,
  Importer, Skripte und ISMS-Tests entfernt (Fundament bleibt: Auth, Identity,
  MFA/WebAuthn, RBAC, Audit, Mail, Storage, Backup/DSGVO, Plattform-Admin)
- Schema auf Fundament-Modelle reduziert; TenantSettings generisch (+phone/email)
- TENANT_MODELS (db.ts, backup/topology.ts) und PII-Felder ausgedünnt
- RBAC: Rollen tenant-admin/backoffice/team-lead/technician + Craftvia-Permissions
- Modul-Katalog (customers, sites, teams, work_orders, imports, field, reports,
  emergency, documents, notifications, lotse) + Navigation aus src/lib/nav.ts
- Modul-Routen mit requireModule-Layout und Platzhalterseite
- Message-Katalog je Namespace (messages/<locale>/<namespace>.json), fs-Loader
- check-module-guards: Modul-Key aus src/server/actions/<moduleKey>/
- Provisionierung, Admin-Konsole, Einstellungen, Files-Route, Mail entkoppelt
- Seed minimal (demo/demo2, Nutzer je Rolle); Fundament-Tests auf Role/
  NotificationPreference-Fixtures umgestellt

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/test-action-error.ts

@@ -25,7 +25,7 @@ const ok = (cond: boolean, msg: string) => {
 };
 
 const SLUG = "zz-actionerr-test";
-const ENTITY = "risk_ae_test";
+const ENTITY = "customer_ae_test";
 
 async function cleanup() {
   const tenant = await prisma.tenant.findFirst({
@@ -49,7 +49,7 @@ async function main() {
   let outward = "";
   try {
     await withActionErrors(async () => {
-      throw new ForbiddenError("risk:write" as Permission);
+      throw new ForbiddenError("customer:write" as Permission);
     }, ctx);
   } catch (e) {
     outward = e instanceof Error ? e.message : String(e);