Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation
und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prisma/migrations/20260728105241_onboarding_progress/migration.sql

@@ -0,0 +1,32 @@
+-- CreateEnum
+CREATE TYPE "OnboardingStepStatus" AS ENUM ('offen', 'in_bearbeitung', 'zur_validierung', 'validiert');
+
+-- CreateTable
+CREATE TABLE "onboarding_progress" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "step_key" TEXT NOT NULL,
+    "status" "OnboardingStepStatus" NOT NULL DEFAULT 'offen',
+    "review_comment" TEXT,
+    "reviewer_id" TEXT,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "onboarding_progress_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "onboarding_progress_tenant_id_idx" ON "onboarding_progress"("tenant_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "onboarding_progress_tenant_id_step_key_key" ON "onboarding_progress"("tenant_id", "step_key");
+
+-- RLS für die neue mandantenbezogene Tabelle.
+DO $$
+DECLARE t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['onboarding_progress'] LOOP
+    EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', t);
+    EXECUTE format('CREATE POLICY tenant_isolation ON %I USING (tenant_id = current_setting(''app.tenant_id'', true))', t);
+  END LOOP;
+END $$;