feat: scaffold klarbild foundation (astro+postgres+s3, auth, migrations, health)

- Astro 5 SSR (node standalone) + React, OKLCH tokens (no tailwind)
- migrations/001_init.sql: full schema per 03-datenmodell-api
- lib: db+migrations, crypto (AES-256-GCM), auth (argon2+signed session, ratelimit),
  storage (S3/MinIO, presigned URLs), openrouter (POST /v1/images, cost)
- middleware: init-once + session guard + admin gate; /api/health (db+storage)
- login + studio placeholder; seeds (till/lea, default recipes); Dockerfile
- verified: astro build passes

src/pages/api/health.ts

@@ -0,0 +1,26 @@
+import type { APIRoute } from 'astro';
+import { pool } from '../../lib/db';
+import { s3 } from '../../lib/storage';
+import { HeadBucketCommand } from '@aws-sdk/client-s3';
+
+export const prerender = false;
+
+export const GET: APIRoute = async () => {
+  const out: Record<string, string> = { service: 'klarbild' };
+  let ok = true;
+
+  try { await pool.query('SELECT 1'); out.db = 'ok'; }
+  catch { out.db = 'fehler'; ok = false; }
+
+  try {
+    await s3.send(new HeadBucketCommand({ Bucket: process.env.S3_BUCKET || 'klarbild' }));
+    out.storage = 'ok';
+  } catch { out.storage = 'fehler'; ok = false; }
+
+  out.queue = 'todo'; // wird mit pg-boss-Phase geprüft
+  out.status = ok ? 'ok' : 'degraded';
+  return new Response(JSON.stringify(out), {
+    status: ok ? 200 : 503,
+    headers: { 'Content-Type': 'application/json' },
+  });
+};