feat(backend): Auth/Users/Audit-Modul (Modul 1)

AuthModule: Login/Refresh/Logout mit JWT-Access-Token + rotierendem,
gehashtem Refresh-Token (RefreshToken-Tabelle). JwtAuthGuard + RolesGuard
global via APP_GUARD registriert (gilt fuer jeden kuenftigen Endpunkt),
@Public()-Decorator als Ausnahme (Auth-Endpunkte, /health).

UsersModule: CRUD + Deactivate, nur ADMIN-Rolle, Passwoerter mit bcrypt
gehasht, nie im Response enthalten.

AuditModule: AuditLogService (Grundstruktur), wird von UsersService bei
create/update/deactivate injiziert und geschrieben.

Geteilte App-Konfiguration (Prefix/Versioning/Pipes/Helmet) aus main.ts
in src/app.config.ts extrahiert; e2e-Tests nutzten das vorher nicht und
bekamen dadurch 404 auf jede /api/v1/... Route - jetzt ueber
test/utils/create-test-app.ts geteilt, betrifft alle kuenftigen
e2e-Tests gleichermassen.

prisma/seed.ts legt einen Admin-User fuer lokale Entwicklung an.

26 Unit-Tests + 11 e2e-Tests (gegen echte Postgres-Testdatenbank) gruen,
Lint/Typecheck/Build gruen, Login/Refresh/Logout/Rollenpruefung manuell
gegen laufenden Server verifiziert.

ApiCore-Backend/src/users/users.service.spec.ts

@@ -0,0 +1,125 @@
+import { ConflictException, NotFoundException } from '@nestjs/common';
+import { UsersService } from './users.service';
+import { PrismaService } from '../prisma/prisma.service';
+import { AuditLogService } from '../audit/audit-log.service';
+
+describe('UsersService', () => {
+  let usersService: UsersService;
+  let prisma: {
+    user: {
+      findMany: jest.Mock;
+      findUnique: jest.Mock;
+      create: jest.Mock;
+      update: jest.Mock;
+    };
+  };
+  let auditLog: { record: jest.Mock };
+
+  const existingUser = {
+    id: 'user-1',
+    email: '[email protected]',
+    passwordHash: 'hashed',
+    name: 'Existing User',
+    role: 'STAFF',
+    isActive: true,
+    createdAt: new Date(),
+    deactivatedAt: null,
+  };
+
+  beforeEach(() => {
+    prisma = {
+      user: {
+        findMany: jest.fn(),
+        findUnique: jest.fn(),
+        create: jest.fn(),
+        update: jest.fn(),
+      },
+    };
+    auditLog = { record: jest.fn().mockResolvedValue(undefined) };
+    usersService = new UsersService(
+      prisma as unknown as PrismaService,
+      auditLog as unknown as AuditLogService,
+    );
+  });
+
+  it('findAll returns summaries without the password hash', async () => {
+    prisma.user.findMany.mockResolvedValue([existingUser]);
+
+    const result = await usersService.findAll();
+
+    expect(result).toEqual([
+      {
+        id: existingUser.id,
+        email: existingUser.email,
+        name: existingUser.name,
+        role: existingUser.role,
+        isActive: existingUser.isActive,
+        createdAt: existingUser.createdAt,
+        deactivatedAt: existingUser.deactivatedAt,
+      },
+    ]);
+    expect(result[0]).not.toHaveProperty('passwordHash');
+  });
+
+  it('findById throws NotFoundException when the user is missing', async () => {
+    prisma.user.findUnique.mockResolvedValue(null);
+    await expect(usersService.findById('missing')).rejects.toBeInstanceOf(
+      NotFoundException,
+    );
+  });
+
+  it('create throws ConflictException when the email is already in use', async () => {
+    prisma.user.findUnique.mockResolvedValue(existingUser);
+    await expect(
+      usersService.create({
+        email: existingUser.email,
+        password: 'password123',
+        name: 'New',
+        role: 'STAFF',
+      }),
+    ).rejects.toBeInstanceOf(ConflictException);
+  });
+
+  it('create hashes the password, persists the user, and records an audit entry', async () => {
+    prisma.user.findUnique.mockResolvedValue(null);
+    prisma.user.create.mockResolvedValue({
+      ...existingUser,
+      id: 'user-2',
+      email: '[email protected]',
+    });
+
+    const result = await usersService.create({
+      email: '[email protected]',
+      password: 'password123',
+      name: 'New User',
+      role: 'STAFF',
+    });
+
+    expect(result.id).toBe('user-2');
+    const [[createArg]] = prisma.user.create.mock.calls as [
+      [{ data: { email: string; passwordHash: string } }],
+    ];
+    expect(createArg.data.email).toBe('[email protected]');
+    expect(createArg.data.passwordHash).not.toBe('password123');
+    expect(auditLog.record).toHaveBeenCalledWith(
+      expect.objectContaining({ entityType: 'User', action: 'CREATE' }),
+    );
+  });
+
+  it('deactivate sets isActive to false and records an audit entry', async () => {
+    prisma.user.findUnique.mockResolvedValue(existingUser);
+    prisma.user.update.mockResolvedValue({
+      ...existingUser,
+      isActive: false,
+      deactivatedAt: new Date(),
+    });
+
+    const result = await usersService.deactivate(existingUser.id);
+
+    expect(result.isActive).toBe(false);
+    expect(result.deactivatedAt).not.toBeNull();
+    expect(auditLog.record).toHaveBeenCalledWith(
+      expect.objectContaining({ entityType: 'User', action: 'DEACTIVATE' }),
+    );
+  });
+});