refactor: rebuild template — Tailwind v4, Docker self-hosting, passkey auth

Toolchain fixes (all previously broken):
- npm run lint: next lint was removed in Next 16 -> eslint with flat config
- .eslintrc.json was ignored by ESLint 9 -> eslint.config.mjs
- npm test / test:e2e exited 1 with no tests -> passWithNoTests
- Vitest scanned tests/ and would have run Playwright specs -> scoped to src/
- Playwright targeted Mobile Safari while docs installed only chromium
- reuseExistingServer silently tested a foreign server on :3000 -> E2E_PORT
- 11 high-severity vulns -> npm audit fix
- deny rule Read(**/.env*) also blocked .env.example -> precise patterns

Stack changes:
- Tailwind v3 -> v4 (CSS-first, no tailwind.config.ts, tw-animate-css)
- shadcn regenerated for v4; 33 components -> 6 core, bundled radix-ui
- Supabase removed entirely; data layer is now chosen per project
- Vercel removed; Docker Compose self-hosting with scripts/update.sh
- Better Auth + passkey plugin as the binding auth standard
- ThemeProvider and Sonner mounted; dark mode and toasts now actually work

Workflow system:
- Sub-agents wired: /frontend, /backend, /qa delegate to .claude/agents
- Checklists folded into their SKILL.md; one file per skill
- Rules rewritten: DB-agnostic backend, passkey security, v4 frontend
- Spec language settled as German, skill instructions English

.claude/skills/write-spec/template.md

@@ -1,63 +1,60 @@
-# PROJ-X: Feature Name
+# PROJ-X: Feature-Name
 
-## Status: Planned
-**Created:** YYYY-MM-DD
-**Last Updated:** YYYY-MM-DD
+**Status:** Planned
+**Erstellt:** YYYY-MM-DD
+**Zuletzt geändert:** YYYY-MM-DD
 
-## Dependencies
-- None
+## Abhängigkeiten
+- Keine
 
 ## User Stories
-- As a [user type], I want to [action] so that [goal]
+- Als [Nutzertyp] möchte ich [Aktion], um [Ziel] zu erreichen
 
 ## Out of Scope
-<!-- What this feature explicitly does NOT cover. Critical for developer handoffs. -->
-- _Example: Bulk operations (deferred to P1 — PROJ-X)_
-- _Example: Admin view of other users' data (separate admin feature)_
+<!-- Was dieses Feature bewusst NICHT abdeckt. Kritisch für die Übergabe an die Entwicklung. -->
+- _Beispiel: Massenbearbeitung — verschoben auf PROJ-5_
+- _Beispiel: Admin-Sicht auf fremde Daten — eigenes Feature_
 
 ## Acceptance Criteria
-
-**Format:** Angenommen [Vorbedingung] / Wenn [Aktion] / Dann [Ergebnis]
-
-- [ ] Angenommen [Vorbedingung], wenn [Aktion], dann [Ergebnis]
-- [ ] Angenommen [Vorbedingung], wenn [Aktion], dann [Ergebnis]
+<!-- Format: Angenommen [Vorbedingung], wenn [Aktion], dann [Ergebnis] -->
+- [ ] Angenommen …, wenn …, dann …
+- [ ] Angenommen …, wenn …, dann …
 
 ## Edge Cases
-- What happens when...?
-- How do we handle...?
+- Was passiert, wenn …?
+- Wie behandeln wir …?
 
-## Technical Requirements (optional)
-- Performance: < 200ms response time
-- Security: Authentication required
-- Browser Support: Chrome, Firefox, Safari
+## Technische Anforderungen (optional)
+- Performance: …
+- Sicherheit: Anmeldung erforderlich (Better Auth, Passkey primär)
+- Browser: Chrome, Firefox, Safari
 
-## Open Questions
-<!-- Unresolved questions from the spec interview. Close them in /refine when answered. -->
-- [ ] Question 1
+## Offene Fragen
+<!-- Ungeklärtes aus dem Interview. Wird in /refine geschlossen. -->
+- [ ] Frage 1
 
-## Decision Log
-<!-- Record of conscious decisions made and why. Added to by /write-spec and /architecture. -->
+## Entscheidungslog
 
-### Product Decisions
-<!-- Added by /write-spec -->
-| Decision | Rationale | Date |
-|----------|-----------|------|
-| _Example: Limit to 3 tags per item_ | _Keeps UI simple for MVP; can be raised later_ | YYYY-MM-DD |
+### Produkt-Entscheidungen
+<!-- von /write-spec -->
+| Entscheidung | Begründung | Datum |
+|--------------|------------|-------|
+| _Beispiel: max. 3 Tags pro Eintrag_ | _Hält die UI im MVP einfach, später erweiterbar_ | YYYY-MM-DD |
 
-### Technical Decisions
-<!-- Added by /architecture -->
-| Decision | Rationale | Date |
-|----------|-----------|------|
-| _Example: localStorage over Supabase_ | _No user accounts needed; data is device-local_ | YYYY-MM-DD |
+### Technische Entscheidungen
+<!-- von /architecture -->
+| Entscheidung | Begründung | Datum |
+|--------------|------------|-------|
+| _Beispiel: localStorage statt Datenbank_ | _Keine Nutzerkonten, Daten bleiben gerätelokal_ | YYYY-MM-DD |
 
 ---
-<!-- Sections below are added by subsequent skills -->
+<!-- Die folgenden Abschnitte ergänzen die nachgelagerten Skills -->
 
-## Tech Design (Solution Architect)
-_To be added by /architecture_
+## Tech Design
+_wird von /architecture ergänzt_
 
 ## QA Test Results
-_To be added by /qa_
+_wird von /qa ergänzt_
 
 ## Deployment
-_To be added by /deploy_
+_wird von /deploy ergänzt_