Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation
und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prisma/migrations/20260722071432_user_mgmt_and_platform_settings/migration.sql

@@ -0,0 +1,22 @@
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN     "mfa_enrolled_at" TIMESTAMP(3),
+ADD COLUMN     "must_change_password" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "recovery_codes" JSONB NOT NULL DEFAULT '[]';
+
+-- CreateTable
+CREATE TABLE "platform_settings" (
+    "id" TEXT NOT NULL DEFAULT 'singleton',
+    "mfa_required" BOOLEAN NOT NULL DEFAULT false,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "platform_settings_pkey" PRIMARY KEY ("id")
+);
+
+
+-- platform_settings ist plattformweit (kein tenant_id) → RLS nicht aktiviert.
+GRANT SELECT, INSERT, UPDATE, DELETE ON "platform_settings" TO isms_app;
+
+-- Singleton-Zeile anlegen (MFA-Pflicht standardmäßig aus).
+INSERT INTO "platform_settings" ("id", "mfa_required", "updated_at")
+VALUES ('singleton', false, now())
+ON CONFLICT ("id") DO NOTHING;