add composer-unused, comprehensive docs, and project restructure

- Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks
- Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists
- Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services
- Add Microsoft OIDC SSO, API token management, and user lifecycle features
- Add swagger-ui vendor integration and OpenAPI spec
- Add production Docker setup and bin/ scripts
- Update composer dependencies, config, templates, and frontend assets throughout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/Http/AccessControl.php

@@ -10,18 +10,13 @@ use MintyPHP\Router;
  */
 class AccessControl
 {
-    /** Paths that are always public (no auth required) */
-    private const ALWAYS_PUBLIC_PATHS = [
-        'login',
-        'register',
-        'verify-email',
-    ];
-
     /** Prefixes that are always public */
     private const ALWAYS_PUBLIC_PREFIXES = [
-        'password/',
         'branding/',
+        'auth/tenant-avatar-file',
         'flash/',
+        'auth/microsoft/',
+        'api/',
     ];
 
     private array $configuredPublicPaths;
@@ -56,11 +51,6 @@ class AccessControl
             }
         }
 
-        // Check always-public paths
-        if (in_array($normalizedPath, self::ALWAYS_PUBLIC_PATHS, true)) {
-            return true;
-        }
-
         // Check always-public prefixes
         foreach (self::ALWAYS_PUBLIC_PREFIXES as $prefix) {
             if (str_starts_with($normalizedPath, $prefix)) {