Reorganize into monorepo layout, move mitarbeiter-app to legacy reference

Consolidates the previously separate omsorgapp and omsorgCore repos
(each had their own nested .git with GitHub history) plus the old
root-level website/mitarbeiter-app into a single monorepo, matching
the structure already documented in the root CLAUDE.md. Also moves
the PHP employee app aside as omsorgWeb/mitarbeiter-app-legacy/ to
serve as a template for a ground-up rewrite.

Fixes .gitignore in the same pass: the config-secrets/uploads/data
patterns were unanchored (relative to repo root, not depth-agnostic),
so they silently stopped matching once the app moved under omsorgWeb/.
Patterns are now **/-prefixed and cover both mitarbeiter-app and
mitarbeiter-app-legacy, keeping DB/SMTP credentials and uploaded
employee documents out of version control.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgapp/electron/backend/authClient.cjs

@@ -0,0 +1,73 @@
+const { request } = require('./httpClient.cjs');
+
+// Kapselt /api/auth/* von omsorgCore. Kennt die Feldnamen der LoginResponse
+// (camelCase, da ASP.NET Core standardmäßig camelCase-JSON ausgibt).
+function toTokenPair(data) {
+  return {
+    accessToken: data.accessToken,
+    refreshToken: data.refreshToken,
+    expiresAt: data.expiresAt,
+    mustChangePassword: !!data.mustChangePassword
+  };
+}
+
+async function login(username, password) {
+  const result = await request('POST', '/api/auth/login', { body: { username, password } });
+  if (!result.ok) {
+    return { ok: false, status: result.status, error: result.error || result.data?.error };
+  }
+  return { ok: true, ...toTokenPair(result.data) };
+}
+
+async function refresh(refreshToken) {
+  const result = await request('POST', '/api/auth/refresh', { body: { refreshToken } });
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, ...toTokenPair(result.data) };
+}
+
+async function logout(refreshToken) {
+  const result = await request('POST', '/api/auth/logout', { body: { refreshToken } });
+  return { ok: result.ok, status: result.status };
+}
+
+async function me(accessToken) {
+  const result = await request('GET', '/api/auth/me', { accessToken });
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, username: result.data.username, role: result.data.role, permissions: result.data.permissions };
+}
+
+async function requestPasswordReset(username) {
+  const result = await request('POST', '/api/auth/forgot-password/request', { body: { username } });
+  if (!result.ok) return { ok: false, status: result.status };
+  return { ok: true, status: result.data.status };
+}
+
+async function verifyPasswordResetCode(username, pin) {
+  const result = await request('POST', '/api/auth/forgot-password/verify', { body: { username, pin } });
+  if (!result.ok) return { ok: false, status: result.status, error: result.data?.error };
+  return { ok: true, resetToken: result.data.resetToken };
+}
+
+async function resetPassword(resetToken, newPassword) {
+  const result = await request('POST', '/api/auth/forgot-password/reset', { body: { resetToken, newPassword } });
+  return { ok: result.ok, status: result.status };
+}
+
+async function changePassword(accessToken, currentPassword, newPassword) {
+  const result = await request('POST', '/api/auth/change-password', {
+    body: { currentPassword, newPassword },
+    accessToken
+  });
+  return { ok: result.ok, status: result.status, data: result.data };
+}
+
+module.exports = {
+  login,
+  refresh,
+  logout,
+  me,
+  requestPasswordReset,
+  verifyPasswordResetCode,
+  resetPassword,
+  changePassword
+};