docs: README aktualisieren, Dev-Log/Dateiindex/GoBD-Checklist/Screenshots ins Repo

README: Feature-Tabelle und Inhaltsverzeichnis auf aktuellen Stand gebracht
(POP3, OCR, eDiscovery, DSGVO, Retention, LDAP, TOTP, IMAP-Server,
Prometheus, Tenant-Export etc. ergänzt).

Zusätzlich aufgenommen: CODEBASE.md (Dateiindex, Stand 2026-03-31 — vor
PROJ-44 eingefroren, sollte bei Gelegenheit aktualisiert werden), DEVLOG.md
(Session-Log), docs/GOBD_DSGVO_CHECKLIST.md (Compliance-Checkliste),
resume (Session-Notiz), screenshots/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CODEBASE.md

@@ -0,0 +1,262 @@
+# archivmail — Dateiindex
+
+> Vollständiger Überblick aller Dateien und ihrer Funktion. Stand: 2026-03-31.
+
+---
+
+## Konfigurationsdateien (Root)
+
+- `go.mod` — Go-Moduldefinition (pgx, imap, smtp, jwt, ldap, crypto, yaml)
+- `go.sum` — Go-Dependency-Lockfile
+- `package.json` — Next.js/Node.js Projektdefinition (React, Tailwind, shadcn/ui)
+- `package-lock.json` — npm-Lockfile
+- `tsconfig.json` — TypeScript-Konfiguration
+- `components.json` — shadcn/ui Konfiguration (Alias-Pfade, Style)
+- `docker-compose.yml` — Docker-Komposedatei für lokale Entwicklung
+- `config.test.yml` — Test-Konfiguration
+- `CLAUDE.md` — Projektdokumentation für Claude (Architektur, Konventionen)
+- `CODEBASE.md` — Dieser Dateiindex
+- `DEVLOG.md` — Entwicklungslog
+- `.eslintrc.json` — ESLint-Konfiguration
+
+---
+
+## cmd/ — Go-Einstiegspunkte
+
+### cmd/archivmail/
+- `main.go` — HTTP-API-Server: initialisiert Storage, Index, Auth, SMTP-Daemon, IMAP-Server, Audit, Mailer, Tenants, Labels, TokenStore
+- `cmd_import.go` — `archivmail import`: EML/MBOX-Import mit --file/--dir/--recursive/--dry-run
+- `cmd_export.go` — `archivmail export`: Export als EML/MBOX mit Filtern
+- `cmd_import_piler.go` — `archivmail import-piler`: Import aus piler-Archiven
+- `cmd_migrate_tenants.go` — `archivmail migrate-tenants`: E-Mails zu Mandanten-Index migrieren
+- `version.go` — AppVersion + Modul-Versionen
+
+### cmd/archivmail-export/
+- `main.go` — Standalone-Export-Tool (alle Mails → EML-Verzeichnis)
+
+### cmd/archivmail-import/
+- `main.go` — Standalone-Import-Tool (EML-Batch mit Indexierung)
+
+---
+
+## internal/ — Interne Go-Pakete
+
+### internal/api/
+- `server.go` — Server-Struct, alle Routen, Middleware (auth, tenant, requireRole)
+- `auth_handlers.go` — Login, Logout, Passwort-Änderung, TOTP-Init/Verify
+- `onboarding_handlers.go` — Signup, Email-Verifikation, Forgot-Password, Reset-Password (PROJ-28)
+- `invite_handlers.go` — Einladungslinks erstellen + prüfen (PROJ-28)
+- `totp_handlers.go` — TOTP-Enrollment und Verification
+- `search_handlers.go` — GET /api/search: Fulltext-Suche mit Paginierung
+- `mail_handlers.go` — GET /api/mails/{id}: Mail-Abruf, Attachments, Raw
+- `admin_handlers.go` — User-CRUD, Audit-Log, Health, Version
+- `quota_handlers.go` — Tenant-Quota GET/SET, Usage-Abfrage (PROJ-29)
+- `retention_handlers.go` — Retention-Policy, Purge (PROJ-34)
+- `import_handlers.go` — Batch-Mail-Upload mit Progress-Tracking (Job-ID)
+- `export.go` — Export-Endpoint (EML/ZIP)
+- `dashboard_handlers.go` — System-Statistiken: Storage, Mails, Uptime, Aktivität
+- `cert_handlers.go` — TLS-Zertifikat-Verwaltung
+- `imap_settings_handlers.go` — IMAP-Modus-Konfiguration pro Tenant
+- `label_handlers.go` — Label-CRUD + Auto-Rules
+- `ldap_sync.go` — LDAP-Benutzer-Synchronisation
+- `ldap_tenants.go` — Per-Tenant-LDAP-Endpoints (PROJ-23)
+- `profile_handlers.go` — GET/PATCH /api/profile
+- `version_handlers.go` — GET /api/version
+- `upload.go` — Upload-Job-Management
+
+### internal/auth/
+- `auth.go` — JWT-Issuing, bcrypt-Passwort-Hashing, LDAP-Fallback, Tenant-Kontext
+- `totp.go` — TOTP (RFC 6238), QR-Code-Generierung
+
+### internal/audit/
+- `audit.go` — Audit-Logger: DB + Flat-File, alle sicherheitsrelevanten Ereignisse
+
+### internal/storage/
+- `storage.go` — AES-256-GCM-Dateispeicher + PostgreSQL-Metadaten, SHA-256-Dedup
+- `quota.go` — CheckQuota() mit 60s-Cache, ErrQuotaExceeded (PROJ-29)
+- `storage_stats.go` — MailActivityStats(), StorageEstimateStats()
+
+### internal/index/
+- `index.go` — Indexer-Interface + Factory (Xapian, Stub)
+- `xapian.go` — Xapian-CGO-Wrapper (Volltext-Index)
+- `xapian_stub.go` — Stub für Builds ohne Xapian
+- `worker.go` — Async Index-Worker (Queue)
+- `tenant_manager.go` — TenantIndexManager (Pro-Tenant-Indizes)
+- `tenant_worker.go` — Tenant-aware Index-Worker
+
+### internal/imap/
+- `store.go` — IMAP-Account-Store (verschlüsselte Credentials)
+- `client.go` — IMAP-Client (Verbindung, Fetch)
+- `importer.go` — IMAP-Importer (Sync → Storage)
+- `scheduler.go` — Periodischer IMAP-Sync
+
+### internal/imapserver/
+- `server.go` — IMAP4-Archive-Server (Read-Only, PROJ-26)
+
+### internal/pop3/
+- `store.go` — POP3-Account-Store
+- `client.go` — POP3-Client
+- `importer.go` — POP3-Importer
+
+### internal/smtpd/
+- `smtpd.go` — SMTP-Daemon: eingehende Mails → Storage + Index, Tenant-Routing
+
+### internal/ldapauth/
+- `client.go` — LDAP-Authentifizierung gegen AD/OpenLDAP
+
+### internal/ldapconfig/
+- `store.go` — Globale LDAP-Konfiguration (verschlüsselt)
+- `tenant_store.go` — Per-Tenant-LDAP-Konfiguration (PROJ-23)
+
+### internal/mailer/
+- `mailer.go` — SMTP-Out-Client via net/smtp (TLS + STARTTLS), kein externer Dependency
+- `templates.go` — HTML+Text-Templates: Verify, Reset, Invite, AlreadyRegistered
+
+### internal/userstore/
+- `userstore.go` — User-CRUD: Create, CreateInactive, Activate, GetByEmail, SetPassword, VerifyPassword, Update, Delete, List
+
+### internal/tenantstore/
+- `store.go` — Tenant-CRUD + Domains, IMAP-Modus, Retention-Days, Logo
+- `quota.go` — SetQuota(), GetQuota(), GetUsage() (PROJ-29)
+
+### internal/labelstore/
+- `store.go` — Label-CRUD + Auto-Rules (From/To/Subject-basiert)
+
+### internal/tokenstore/
+- `store.go` — auth_tokens: Create (32-Byte random, SHA-256), Use (einmalig), Peek, Cleanup (PROJ-28)
+
+---
+
+## pkg/ — Öffentliche Pakete
+
+### pkg/mailparser/
+- `parser.go` — RFC 5822 Parser: From, To, CC, Subject, Body (Text+HTML), Attachments
+- `mbox.go` — MBOX-Splitter
+
+---
+
+## config/
+- `config.go` — YAML-Konfiguration: ServerConfig (fqdn), APIConfig, StorageConfig, DatabaseConfig, SMTPConfig, SMTPOutConfig, IndexConfig, AuditConfig, IMAPServerConfig
+
+---
+
+## src/app/ — Next.js Seiten (App Router)
+
+- `layout.tsx` — Root-Layout: Navbar, Theme-Provider, Toaster
+- `page.tsx` — Login: Username/Passwort, Links zu Signup + Forgot-Password
+- `signup/page.tsx` — Self-Service Registrierung (+ Invite-Token-Support)
+- `verify/page.tsx` — Email-Verifikation via Token
+- `forgot-password/page.tsx` — Passwort-Reset-Anfrage
+- `reset-password/page.tsx` — Neues Passwort setzen via Token
+- `search/page.tsx` — Fulltext-Suche mit Filtern, Pagination, Labels
+- `mail/[id]/page.tsx` — Mail-Detail: Headers, Body, Attachments
+- `settings/page.tsx` — Profil, Passwort, TOTP, Labels, IMAP/POP3
+- `imap/page.tsx` — IMAP-Account-Konfiguration
+- `pop3/page.tsx` — POP3-Account-Konfiguration
+- `admin/page.tsx` — Admin-Dashboard (Multi-Tab)
+- `admin/upload/page.tsx` — Batch-Mail-Import mit Progress
+
+---
+
+## src/components/
+
+### src/components/ui/ (shadcn/ui Primitive)
+`button`, `input`, `card`, `dialog`, `alert`, `alert-dialog`, `toast`, `toaster`, `sonner`, `select`, `checkbox`, `radio-group`, `switch`, `tabs`, `accordion`, `table`, `form`, `label`, `textarea`, `dropdown-menu`, `popover`, `tooltip`, `breadcrumb`, `pagination`, `badge`, `separator`, `scroll-area`, `skeleton`, `command`, `sheet`, `sidebar`, `navigation-menu`, `avatar`, `progress`, `collapsible`
+
+### src/components/ (Business-Komponenten)
+- `navbar.tsx` — Top-Navigation mit Logo, User-Menu, Theme-Toggle
+- `UserNav.tsx` — User-Dropdown (Profil, Settings, Logout)
+- `theme-toggle.tsx` — Light/Dark-Mode Toggle
+- `theme-provider.tsx` — next-themes Provider
+- `LabelList.tsx` — Label-Navigation
+- `LabelPicker.tsx` — Label-Picker Dropdown
+- `page-skeleton.tsx` — Loading-Skeleton
+
+### src/components/admin/
+- `ModulesTab.tsx` — Feature-Module-Übersicht
+- `UserDialogs.tsx` — Create/Edit/Delete User Dialogs
+- `TenantLDAPDialog.tsx` — LDAP-Konfiguration für Mandant
+
+### src/components/admin/tabs/
+- `DashboardTab.tsx` — System-Stats, Uptime, Mail-Aktivität, Storage-Prognose
+- `UsersTab.tsx` — User-CRUD mit Rollen
+- `TenantsTab.tsx` — Mandanten-CRUD + Domains
+- `LDAPTab.tsx` — Globale LDAP-Konfiguration
+- `TenantLDAPTab.tsx` — Per-Tenant-LDAP
+- `LabelsTab.tsx` — Label + Auto-Rules Verwaltung
+- `AuditTab.tsx` — Audit-Log Viewer
+- `RetentionTab.tsx` — GoBD-Retention pro Tenant (PROJ-34)
+- `QuotaTab.tsx` — Storage-Quota pro Tenant mit Usage-Balken (PROJ-29)
+- `SecurityTab.tsx` — Security-Audit + Fixes
+- `CertTab.tsx` — TLS-Zertifikat-Verwaltung
+- `IMAPSettingsTab.tsx` — IMAP-Modus-Einstellung
+- `ImportTab.tsx` — Batch-Import-Tool
+- `ServicesTab.tsx` — Service-Status (SMTP, IMAP, POP3)
+
+---
+
+## src/lib/
+
+### src/lib/api/
+- `index.ts` — Re-Export aller API-Funktionen (Kompatibilität)
+- `core.ts` — HTTP-Client mit Credentials, Error-Handling
+- `users.ts` — User-API: getUsers, createUser, updateUser, deleteUser, TOTP
+- `mail.ts` — Mail-API: searchEmails, getMail, downloadAttachment, IMAP/POP3
+- `system.ts` — System-API: getHealth, getStats, getServices, getAuditLog, Labels, Certs
+- `tenants.ts` — Tenant-API: CRUD, Domains, Logo, LDAP, Quota (PROJ-29)
+- `ldap.ts` — LDAP-API: getLDAPConfig, saveLDAPConfig, testLDAP, syncLDAP
+
+### src/lib/
+- `auth-cache.ts` — Client-side Auth-Cache (localStorage, TTL)
+- `utils.ts` — classname merging, Datums-Formatierung
+
+---
+
+## src/hooks/
+- `useAuth.ts` — Aktueller User + login/logout
+- `useLDAPConfig.ts` — Globale LDAP-Konfiguration
+- `useTenantLDAPConfig.ts` — Per-Tenant-LDAP
+- `useTenantUsers.ts` — Benutzer eines Mandanten
+- `use-toast.ts` — Toast-Benachrichtigungen
+- `use-mobile.tsx` — Responsive-Breakpoint (768px)
+
+---
+
+## features/ — Feature-Spezifikationen
+
+| ID | Datei | Thema |
+|----|-------|-------|
+| PROJ-1 | `PROJ-1-authentifizierung-und-rollen.md` | JWT-Auth, RBAC |
+| PROJ-2 | `PROJ-2-import-eml-mbox.md` | EML/MBOX-Import |
+| PROJ-3 | `PROJ-3-import-imap.md` | IMAP-Sync |
+| PROJ-4 | `PROJ-4-import-smtp.md` | SMTP-Daemon |
+| PROJ-5 | `PROJ-5-speicherung-und-indexierung.md` | AES-256-GCM Storage, Xapian |
+| PROJ-6 | `PROJ-6-volltext-suche.md` | Volltext-Suche |
+| PROJ-7 | `PROJ-7-email-ansicht.md` | Mail-Viewer |
+| PROJ-8 | `PROJ-8-imap-auto-sync.md` | IMAP-Scheduler |
+| PROJ-9 | `PROJ-9-ordner-und-labels.md` | Labels + Auto-Rules |
+| PROJ-10 | `PROJ-10-admin-bereich.md` | Admin-Panel |
+| PROJ-11 | `PROJ-11-audit-log.md` | Audit-Logging |
+| PROJ-12 | `PROJ-12-export.md` | EML/MBOX-Export |
+| PROJ-13 | `PROJ-13-rest-api-crm.md` | REST-API für CRM |
+| PROJ-14 | `PROJ-14-import-pop3.md` | POP3-Import |
+| PROJ-15 | `PROJ-15-cli-import-export.md` | CLI-Tools |
+| PROJ-16 | `PROJ-16-ldap-active-directory.md` | LDAP/AD-Integration |
+| PROJ-17 | `PROJ-17-system-dashboard.md` | System-Dashboard |
+| PROJ-18 | `PROJ-18-integritaetspruefung.md` | SHA-256-Integrity-Check |
+| PROJ-19 | `PROJ-19-import-piler.md` | piler-Migration |
+| PROJ-20 | `PROJ-20-nutzer-loeschung.md` | GoBD-konforme Löschung |
+| PROJ-21 | `PROJ-21-multi-tenancy.md` | Multi-Tenancy |
+| PROJ-22 | `PROJ-22-ldap-webgui.md` | LDAP-Web-GUI |
+| PROJ-23 | `PROJ-23-tenant-ldap-pro-mandant.md` | Per-Tenant-LDAP |
+| PROJ-24 | `PROJ-24-totp-zwei-faktor.md` | TOTP-2FA |
+| PROJ-25 | `PROJ-25-user-profil-einstellungen.md` | User-Profil |
+| PROJ-26 | `PROJ-26-imap-server-schnittstelle.md` | IMAP-Archive-Server |
+| PROJ-27 | `PROJ-27-container-ready.md` | Docker-Support |
+| PROJ-28 | `PROJ-28-self-service-onboarding.md` | Signup, Verify, Password-Reset |
+| PROJ-29 | `PROJ-29-tenant-quotas.md` | Tenant-Quotas |
+| PROJ-30 | `PROJ-30-bleve-migration.md` | Xapian → Manticore |
+| PROJ-31 | `PROJ-31-billing-subscriptions.md` | Billing (geplant) |
+| PROJ-32 | `PROJ-32-message-id-dedup.md` | Message-ID-Dedup |
+| PROJ-33 | `PROJ-33-imap-modus-shared-personal.md` | IMAP Shared/Personal |
+| PROJ-34 | `PROJ-34-retention-policy.md` | GoBD-Retention |