feat: scaffold klarbild foundation (astro+postgres+s3, auth, migrations, health)

- Astro 5 SSR (node standalone) + React, OKLCH tokens (no tailwind)
- migrations/001_init.sql: full schema per 03-datenmodell-api
- lib: db+migrations, crypto (AES-256-GCM), auth (argon2+signed session, ratelimit),
  storage (S3/MinIO, presigned URLs), openrouter (POST /v1/images, cost)
- middleware: init-once + session guard + admin gate; /api/health (db+storage)
- login + studio placeholder; seeds (till/lea, default recipes); Dockerfile
- verified: astro build passes

src/pages/api/auth/login.ts

@@ -0,0 +1,33 @@
+import type { APIRoute } from 'astro';
+import { login, makeSessionCookie, rateLimited, noteFailure, clearFailures } from '../../../lib/auth';
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, clientAddress }) => {
+  const ip = clientAddress || 'unknown';
+  if (rateLimited(ip)) {
+    return new Response(JSON.stringify({ error: 'Zu viele Versuche. Bitte in 15 Minuten erneut.' }),
+      { status: 429, headers: { 'Content-Type': 'application/json' } });
+  }
+  let username = '', password = '';
+  const ct = request.headers.get('content-type') || '';
+  if (ct.includes('application/json')) {
+    const b = await request.json().catch(() => ({}));
+    username = b.username || ''; password = b.password || '';
+  } else {
+    const f = await request.formData();
+    username = String(f.get('username') || ''); password = String(f.get('password') || '');
+  }
+
+  const user = await login(username.trim(), password);
+  if (!user) {
+    noteFailure(ip);
+    return new Response(JSON.stringify({ error: 'Benutzername oder Passwort falsch.' }),
+      { status: 401, headers: { 'Content-Type': 'application/json' } });
+  }
+  clearFailures(ip);
+  return new Response(JSON.stringify({ ok: true, role: user.role }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json', 'Set-Cookie': makeSessionCookie(user) },
+  });
+};

src/pages/api/auth/logout.ts

@@ -0,0 +1,10 @@
+import type { APIRoute } from 'astro';
+import { clearSessionCookie } from '../../../lib/auth';
+
+export const prerender = false;
+
+export const POST: APIRoute = async () =>
+  new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json', 'Set-Cookie': clearSessionCookie() },
+  });

src/pages/api/health.ts

@@ -0,0 +1,26 @@
+import type { APIRoute } from 'astro';
+import { pool } from '../../lib/db';
+import { s3 } from '../../lib/storage';
+import { HeadBucketCommand } from '@aws-sdk/client-s3';
+
+export const prerender = false;
+
+export const GET: APIRoute = async () => {
+  const out: Record<string, string> = { service: 'klarbild' };
+  let ok = true;
+
+  try { await pool.query('SELECT 1'); out.db = 'ok'; }
+  catch { out.db = 'fehler'; ok = false; }
+
+  try {
+    await s3.send(new HeadBucketCommand({ Bucket: process.env.S3_BUCKET || 'klarbild' }));
+    out.storage = 'ok';
+  } catch { out.storage = 'fehler'; ok = false; }
+
+  out.queue = 'todo'; // wird mit pg-boss-Phase geprüft
+  out.status = ok ? 'ok' : 'degraded';
+  return new Response(JSON.stringify(out), {
+    status: ok ? 200 : 503,
+    headers: { 'Content-Type': 'application/json' },
+  });
+};

src/pages/index.astro

@@ -0,0 +1,21 @@
+---
+import Base from '../layouts/Base.astro';
+const user = Astro.locals.user!;
+---
+<Base title="Studio · Klarbild">
+  <section>
+    <h1 class="display">Studio</h1>
+    <p class="lead">Willkommen, {user.name}. Ziehe Screenshots herein, wähle ein Rezept — Klarbild macht daraus druckfertige Bilder.</p>
+    <div class="soon card">
+      <strong>Aufbau läuft.</strong>
+      <p>Das Fundament steht (Login, Datenbank, Objektspeicher, Health). Als Nächstes: Upload, Rezepte, Warteschlange und die Bildpipeline.</p>
+    </div>
+  </section>
+  <style>
+    .display { font-family: var(--font-display); font-size: 2rem; margin: 8px 0 6px; letter-spacing: -0.02em; }
+    .lead { color: var(--ink-soft); max-width: 60ch; }
+    .card { background: var(--surface); border: 1px solid var(--line); border-radius: var(--radius);
+      padding: 20px; box-shadow: var(--shadow); margin-top: 20px; max-width: 60ch; }
+    .card p { color: var(--ink-mute); margin: 6px 0 0; }
+  </style>
+</Base>

src/pages/login.astro

@@ -0,0 +1,41 @@
+---
+import Base from '../layouts/Base.astro';
+if (Astro.locals.user) return Astro.redirect('/');
+---
+<Base title="Anmelden · Klarbild">
+  <section class="login">
+    <h1 class="display">Klarbild</h1>
+    <p class="claim">Screenshot rein, sauberes Bild raus.</p>
+    <form id="f" class="card">
+      <label>Benutzername<input name="username" autocomplete="username" required autofocus /></label>
+      <label>Passwort<input name="password" type="password" autocomplete="current-password" required /></label>
+      <button type="submit">Anmelden</button>
+      <p id="err" class="err" hidden></p>
+    </form>
+  </section>
+  <style>
+    .login { max-width: 360px; margin: 8vh auto 0; text-align: center; }
+    .display { font-family: var(--font-display); font-size: 2.4rem; margin: 0 0 4px; letter-spacing: -0.02em; }
+    .claim { color: var(--ink-mute); margin: 0 0 28px; }
+    .card { display: grid; gap: 14px; text-align: left; background: var(--surface);
+      border: 1px solid var(--line); border-radius: var(--radius); padding: 22px; box-shadow: var(--shadow); }
+    label { display: grid; gap: 6px; font-size: 0.9rem; color: var(--ink-soft); }
+    input { padding: 11px 12px; border: 1px solid var(--line); border-radius: var(--radius-sm);
+      background: var(--paper); color: var(--ink); font-size: 1rem; }
+    button { margin-top: 4px; padding: 11px; border: none; border-radius: var(--radius-sm);
+      background: var(--accent); color: white; font-size: 1rem; font-weight: 600; cursor: pointer; }
+    .err { color: var(--err); font-size: 0.9rem; margin: 4px 0 0; }
+  </style>
+  <script>
+    const f = document.getElementById('f'); const err = document.getElementById('err');
+    f.addEventListener('submit', async (e) => {
+      e.preventDefault(); err.hidden = true;
+      const data = Object.fromEntries(new FormData(f));
+      const res = await fetch('/api/auth/login', {
+        method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data),
+      });
+      if (res.ok) { location.href = '/'; }
+      else { const j = await res.json().catch(() => ({})); err.textContent = j.error || 'Anmeldung fehlgeschlagen.'; err.hidden = false; }
+    });
+  </script>
+</Base>