feat(PROJ-28): Self-Service Onboarding — Signup, Verify, Password Reset, Invites

- internal/mailer: SMTP-Out via net/smtp (TLS + STARTTLS), HTML+Text-Templates
- internal/tokenstore: auth_tokens Tabelle, SHA-256-Hash, TTL, einmalig verwendbar
- userstore: CreateInactive(), Activate(), GetByEmail(), SetPassword()
- API: POST /signup, GET /verify, POST /forgot-password, POST /reset-password
- API: POST /admin/invite (domain_admin+), GET /auth/invite?token (check)
- Login-Seite: Links zu "Passwort vergessen" und "Registrieren"
- Frontend: /signup, /verify, /forgot-password, /reset-password Seiten
- server.fqdn nicht konfiguriert → Startup-Warnung, Self-Service deaktiviert
- LDAP-Nutzer: Passwort-Reset abgewiesen

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/page.tsx

@@ -86,6 +86,14 @@ export default function LoginPage() {
               {loading ? "Anmelden..." : "Anmelden"}
             </Button>
           </form>
+          <div className="mt-4 flex flex-col items-center gap-2 text-sm text-muted-foreground">
+            <a href="/forgot-password" className="hover:text-foreground underline">
+              Passwort vergessen?
+            </a>
+            <a href="/signup" className="hover:text-foreground underline">
+              Noch kein Account? Registrieren
+            </a>
+          </div>
         </CardContent>
       </Card>
     </div>