feat(16-01): apply Group.internalName/ldapObjectGuid migration to local DB

- Migration 20260806133916_add_group_internal_name_and_object_guid applied
  against the local Postgres container (baselined 24 prior migrations first
  — _prisma_migrations was missing, unrelated to this task's DDL)
- New describe block in migration-sql.spec.ts pins internalName,
  ldapObjectGuid, and the (tenantId, ldapObjectGuid) unique index
- Full API test suite green (40 files, 526 tests)

apps/api/src/groups/migration-sql.spec.ts

@@ -94,3 +94,23 @@ describe('groups_rls_policies migration.sql (T-15-11)', () => {
     expect(directPolicyCount).toBe(2);
   });
 });
+
+describe('add_group_internal_name_and_object_guid migration.sql (D-04)', () => {
+  const sql = readMigrationSql('_add_group_internal_name_and_object_guid');
+
+  it('fügt die Spalte internalName hinzu (D-04, sync-immuner Anzeigename)', () => {
+    expect(sql).toContain('internalName');
+  });
+
+  it('fügt die Spalte ldapObjectGuid hinzu (D-04, rename-stabiler Sync-Match-Key)', () => {
+    expect(sql).toContain('ldapObjectGuid');
+  });
+
+  it('legt einen Unique-Index auf (tenantId, ldapObjectGuid) an', () => {
+    expect(sql).toContain('"tenantId", "ldapObjectGuid"');
+  });
+
+  it('enthält keine eigene ENABLE/FORCE ROW LEVEL SECURITY-Anweisung (Group trägt sie bereits aus 20260804130918)', () => {
+    expect(sql).not.toMatch(/ALTER TABLE .* (ENABLE|FORCE) ROW LEVEL SECURITY/);
+  });
+});