M3 Registrierung und Login-Grundlage ergänzen

- SaaS-Auth-Helper und PDO-Datenbankzugriff einführen
- Registrierung, Login, Logout und Kontoansicht ergänzen
- Auth-Migration, Flow-Check und Smoke-Abdeckung aktualisieren

scripts/check-m3-auth-flow.php

@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+require __DIR__ . '/dev-db.php';
+require __DIR__ . '/../app/saas-auth.php';
+
+function auth_check_assert(string $label, bool $condition, array &$failures, int &$passes): void
+{
+    if ($condition) {
+        $passes++;
+        echo "PASS {$label}\n";
+        return;
+    }
+
+    $failures[] = $label;
+    echo "FAIL {$label}\n";
+}
+
+function auth_check_cleanup(PDO $pdo, string $slug, string $emailNorm): void
+{
+    $stmt = $pdo->prepare('SELECT id FROM tenants WHERE slug = ?');
+    $stmt->execute([$slug]);
+    $tenantId = $stmt->fetchColumn();
+
+    if ($tenantId !== false) {
+        $tenantId = (int)$tenantId;
+        $pdo->prepare('DELETE FROM participants WHERE tenant_id = ?')->execute([$tenantId]);
+        $pdo->prepare('DELETE FROM tenant_memberships WHERE tenant_id = ?')->execute([$tenantId]);
+        $pdo->prepare('DELETE FROM tenant_settings WHERE tenant_id = ?')->execute([$tenantId]);
+        $pdo->prepare('DELETE FROM tenants WHERE id = ?')->execute([$tenantId]);
+    }
+
+    $pdo->prepare('DELETE FROM users WHERE email_norm = ?')->execute([$emailNorm]);
+}
+
+$pdo = dev_pdo();
+dev_apply_schema($pdo);
+
+$slug = 'm3-auth-flow-check';
+$email = 'm3-auth-flow-check@test.local';
+$emailNorm = saas_email_norm($email);
+$password = 'M3-auth-flow-123';
+$failures = [];
+$passes = 0;
+
+auth_check_cleanup($pdo, $slug, $emailNorm);
+
+$result = saas_register_tenant_owner($pdo, [
+    'tenant_name' => 'M3 Auth Flow Check',
+    'tenant_slug' => $slug,
+    'display_name' => 'M3 Auth Check',
+    'email' => $email,
+    'password' => $password,
+    'password_confirm' => $password,
+]);
+
+auth_check_assert('registration succeeds', $result['ok'] === true, $failures, $passes);
+
+if ($result['ok']) {
+    $tenantId = (int)$result['identity']['tenant_id'];
+    $userId = (int)$result['identity']['user_id'];
+
+    $stmt = $pdo->prepare('SELECT COUNT(*) FROM tenants WHERE id = ? AND slug = ?');
+    $stmt->execute([$tenantId, $slug]);
+    auth_check_assert('tenant is persisted', (int)$stmt->fetchColumn() === 1, $failures, $passes);
+
+    $stmt = $pdo->prepare('SELECT COUNT(*) FROM tenant_settings WHERE tenant_id = ?');
+    $stmt->execute([$tenantId]);
+    auth_check_assert('tenant settings are persisted', (int)$stmt->fetchColumn() === 1, $failures, $passes);
+
+    $stmt = $pdo->prepare('SELECT COUNT(*) FROM tenant_memberships WHERE tenant_id = ? AND user_id = ? AND role = ?');
+    $stmt->execute([$tenantId, $userId, 'owner']);
+    auth_check_assert('owner membership is persisted', (int)$stmt->fetchColumn() === 1, $failures, $passes);
+
+    $stmt = $pdo->prepare('SELECT COUNT(*) FROM participants WHERE tenant_id = ? AND user_id = ? AND email_norm = ?');
+    $stmt->execute([$tenantId, $userId, $emailNorm]);
+    auth_check_assert('owner participant is persisted', (int)$stmt->fetchColumn() === 1, $failures, $passes);
+}
+
+$login = saas_authenticate($pdo, $email, $password, $slug);
+auth_check_assert('login succeeds', $login['ok'] === true, $failures, $passes);
+if ($login['ok']) {
+    auth_check_assert('login returns owner role', $login['identity']['role'] === 'owner', $failures, $passes);
+    auth_check_assert('login returns tenant slug', $login['identity']['tenant_slug'] === $slug, $failures, $passes);
+}
+
+$badLogin = saas_authenticate($pdo, $email, 'wrong-password', $slug);
+auth_check_assert('wrong password is rejected', $badLogin['ok'] === false, $failures, $passes);
+
+auth_check_cleanup($pdo, $slug, $emailNorm);
+
+if ($failures !== []) {
+    echo "\nM3 auth flow check failed with " . count($failures) . " failure(s):\n";
+    foreach ($failures as $failure) {
+        echo "- {$failure}\n";
+    }
+    exit(1);
+}
+
+echo "\nM3 auth flow check passed with {$passes} assertions.\n";

scripts/http-smoke.php

@@ -51,6 +51,16 @@ $checks = [
         'path' => 'faq.php',
         'contains' => ['FAQ - Kaffeeliste'],
     ],
+    [
+        'label' => 'Login',
+        'path' => 'login.php',
+        'contains' => ['Login', 'Registrieren'],
+    ],
+    [
+        'label' => 'Registrierung',
+        'path' => 'register.php',
+        'contains' => ['Registrierung', 'Kundenkonto anlegen'],
+    ],
     [
         'label' => 'Namensanpassung',
         'path' => 'namenanpassen.php',
@@ -217,4 +227,3 @@ if ($failures !== []) {
 }
 
 echo "\nHTTP smoke passed with {$passes} checked pages.\n";
-