Architektur: Craftvia-Domänenmodell, Verträge und Team-Schnitte

- Migration 0002_craftvia_domain: 27 Fachtabellen inkl. RLS (enable_tenant_rls)
- TENANT_MODELS (db.ts, backup/topology.ts) um alle Fachmodelle ergänzt
- moduleGuard liefert DB-autoritative Rechte; ServiceCtx für Domänen-Services
- Verträge: Statusmaschine, Events, Nummernkreise, Sichtbarkeits-Scopes,
  Job-Queues + Worker, KI-Provider-Interfaces, Sync-Envelope
- docs/craftvia/ARCHITEKTUR.md mit Lanes, Ownership und DoD

Gate: tsc, lint, build, 22/22 Tests grün.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server/action-guard.ts

@@ -73,18 +73,18 @@ export function moduleGuard(moduleKey: string) {
     }
     if (identity.mustChangePassword) throw new Error("Passwortwechsel erforderlich.");
 
-    if (permissions.length > 0) {
-      const effective = new Set(
-        account.userRoles.flatMap((ur) =>
-          ur.role.rolePermissions.map((rp) => rp.permission.key),
-        ),
-      );
-      for (const permission of permissions) {
-        if (!effective.has(permission)) throw new ForbiddenError(permission);
-      }
+    const effective = new Set(
+      account.userRoles.flatMap((ur) =>
+        ur.role.rolePermissions.map((rp) => rp.permission.key),
+      ),
+    );
+    for (const permission of permissions) {
+      if (!effective.has(permission)) throw new ForbiddenError(permission);
     }
 
     await assertModuleEnabled(session, moduleKey);
-    return { session, db };
+    // `permissions` = DB-authoritative effective set; domain services derive their
+    // scope decisions from it (src/server/services/context.ts#ctxFromGuard).
+    return { session, db, permissions: effective as ReadonlySet<string> };
   };
 }