feat: scaffold klarbild foundation (astro+postgres+s3, auth, migrations, health)

- Astro 5 SSR (node standalone) + React, OKLCH tokens (no tailwind)
- migrations/001_init.sql: full schema per 03-datenmodell-api
- lib: db+migrations, crypto (AES-256-GCM), auth (argon2+signed session, ratelimit),
  storage (S3/MinIO, presigned URLs), openrouter (POST /v1/images, cost)
- middleware: init-once + session guard + admin gate; /api/health (db+storage)
- login + studio placeholder; seeds (till/lea, default recipes); Dockerfile
- verified: astro build passes

src/lib/init.ts

@@ -0,0 +1,19 @@
+import { runMigrations } from './db';
+import { ensureBucket } from './storage';
+import { seed } from './seed';
+
+let started: Promise<void> | null = null;
+
+/** Einmalige Server-Initialisierung (idempotent, beim ersten Request ausgelöst). */
+export function ensureInit(): Promise<void> {
+  if (!started) {
+    started = (async () => {
+      await runMigrations();
+      try { await ensureBucket(); } catch (e) { console.error('[init] S3 nicht bereit:', e); }
+      await seed();
+      console.log('[init] Klarbild bereit.');
+      // TODO (Phase Bildkern): pg-boss-Worker hier starten.
+    })().catch((e) => { started = null; throw e; });
+  }
+  return started;
+}