Reorganize into monorepo layout, move mitarbeiter-app to legacy reference

Consolidates the previously separate omsorgapp and omsorgCore repos
(each had their own nested .git with GitHub history) plus the old
root-level website/mitarbeiter-app into a single monorepo, matching
the structure already documented in the root CLAUDE.md. Also moves
the PHP employee app aside as omsorgWeb/mitarbeiter-app-legacy/ to
serve as a template for a ground-up rewrite.

Fixes .gitignore in the same pass: the config-secrets/uploads/data
patterns were unanchored (relative to repo root, not depth-agnostic),
so they silently stopped matching once the app moved under omsorgWeb/.
Patterns are now **/-prefixed and cover both mitarbeiter-app and
mitarbeiter-app-legacy, keeping DB/SMTP credentials and uploaded
employee documents out of version control.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

omsorgapp/electron/preload.cjs

@@ -0,0 +1,36 @@
+const { contextBridge, ipcRenderer } = require('electron');
+contextBridge.exposeInMainWorld('omsorg', {
+  getDb: () => ipcRenderer.invoke('db:get'),
+  setDb: (data) => ipcRenderer.invoke('db:set', data),
+  paths: () => ipcRenderer.invoke('app:paths'),
+  openRoot: () => ipcRenderer.invoke('app:openRoot'),
+  createBackup: () => ipcRenderer.invoke('backup:create'),
+  auth: {
+    login: (username, password) => ipcRenderer.invoke('auth:login', { username, password }),
+    logout: () => ipcRenderer.invoke('auth:logout'),
+    getSession: () => ipcRenderer.invoke('auth:getSession'),
+    onSessionChanged: (callback) => {
+      const listener = (_event, session) => callback(session);
+      ipcRenderer.on('auth:sessionChanged', listener);
+      return () => ipcRenderer.removeListener('auth:sessionChanged', listener);
+    },
+    requestPasswordReset: (username) => ipcRenderer.invoke('auth:requestPasswordReset', { username }),
+    verifyPasswordResetCode: (username, pin) => ipcRenderer.invoke('auth:verifyPasswordResetCode', { username, pin }),
+    resetPassword: (resetToken, newPassword) => ipcRenderer.invoke('auth:resetPassword', { resetToken, newPassword }),
+    changePassword: (currentPassword, newPassword) =>
+      ipcRenderer.invoke('auth:changePassword', { currentPassword, newPassword })
+  },
+  api: {
+    get: (path) => ipcRenderer.invoke('api:get', path),
+    post: (path, body) => ipcRenderer.invoke('api:post', path, body)
+  },
+  employees: {
+    list: (params) => ipcRenderer.invoke('employees:list', params),
+    create: (payload) => ipcRenderer.invoke('employees:create', payload),
+    update: (id, payload) => ipcRenderer.invoke('employees:update', id, payload)
+  },
+  users: {
+    list: () => ipcRenderer.invoke('users:list'),
+    create: (payload) => ipcRenderer.invoke('users:create', payload)
+  }
+});