feat(15-06): phase-wide i18n keys + sixth admin nav entry for groups

- de.json/en.json: admin.groups.* (incl. ldapBind, members, deleteConfirm,
  grants sub-namespaces), admin.users.grants.*, adminModules.grantsLink +
  grants.* + activationDialog.*, modules.accessDenied.*, marketplace
  statusNoAccess/toastNoAccess, header.admin.groups -- covers this plan's
  /admin/groups surface plus the Wave 4 surfaces (permission matrix,
  user-detail grants, activation dialog, 403 page, marketplace badge) so
  15-07/15-08 can run in parallel without touching the translation files
- admin-sidebar.tsx: sixth nav entry "Gruppen" -> /admin/groups with a
  roster/list icon (Lucide list glyph, distinct from the users icon)

apps/web/src/messages/en.json

@@ -75,7 +75,8 @@
       "tenants": "Tenants",
       "modules": "Modules",
       "ldap": "LDAP",
-      "smtp": "SMTP"
+      "smtp": "SMTP",
+      "groups": "Groups"
     },
     "role": {
       "SUPER_ADMIN": "Super Admin",
@@ -264,7 +265,21 @@
       "status": "Status",
       "actions": "Actions",
       "password": "Password",
-      "noUsers": "No users found"
+      "noUsers": "No users found",
+      "grants": {
+        "detailsButton": "Details",
+        "modalTitle": "{username} — Access",
+        "groupsSection": "Group Memberships",
+        "noGroups": "This user is not a member of any group.",
+        "accessSection": "Module Access",
+        "moduleColumn": "Module",
+        "viaGroupsColumn": "Via Group(s)",
+        "directColumn": "Direct",
+        "noInheritance": "–",
+        "noActiveModules": "No modules are activated for this tenant.",
+        "directCheckboxLabel": "{granted, select, true {Grant} other {Revoke}} {module} directly for {user}",
+        "saveError": "Could not save grant. Please try again."
+      }
     },
     "tenants": {
       "title": "Tenant Management",
@@ -353,6 +368,52 @@
         "skipped": "skipped",
         "errors": "errors"
       }
+    },
+    "groups": {
+      "title": "Groups",
+      "create": "Create Group",
+      "edit": "Edit Group",
+      "delete": "Delete Group",
+      "noGroups": "No groups yet",
+      "noGroupsBody": "Create your first group to grant module access selectively.",
+      "name": "Name",
+      "ldapBinding": "AD Binding",
+      "boundBadge": "AD-bound",
+      "manualBadge": "Manual",
+      "defaultGroup": "Default Group",
+      "setDefault": "Set as default group",
+      "isDefault": "Default group",
+      "memberCount": "Members",
+      "actions": "Actions",
+      "membersButton": "Members",
+      "saveError": "Could not save group. Please try again.",
+      "deleteError": "Could not delete group. Please try again.",
+      "ldapBind": {
+        "hint": "Choose an AD group from the list to sync membership automatically.",
+        "bound": "Bound to: {ldapDn}",
+        "unbind": "Remove binding",
+        "searchPlaceholder": "Search AD groups...",
+        "discoverError": "Could not load AD groups. Please try again.",
+        "noResults": "No AD groups found."
+      },
+      "members": {
+        "title": "Members",
+        "remove": "Remove member",
+        "ldapManaged": "Managed via AD sync",
+        "sourceManual": "Manual",
+        "sourceLdap": "LDAP",
+        "addTitle": "Add member",
+        "searchPlaceholder": "Search users...",
+        "noMembers": "No members yet.",
+        "addError": "Could not add member. Please try again."
+      },
+      "deleteConfirm": {
+        "title": "Delete Group",
+        "body": "This group has {memberCount} members and {grantCount} module grants. Affected users will lose access unless they have it another way. This action cannot be undone."
+      },
+      "grants": {
+        "matrixCheckboxLabel": "{granted, select, true {Grant} other {Revoke}} {module} for group {group}"
+      }
     }
   },
   "adminModules": {
@@ -367,7 +428,24 @@
     "noModules": "No modules available",
     "activateSuccess": "Module activated successfully",
     "deactivateSuccess": "Module deactivated successfully",
-    "error": "Error managing module"
+    "error": "Error managing module",
+    "grantsLink": "Grants Matrix",
+    "grants": {
+      "title": "Grants Matrix",
+      "searchPlaceholder": "Search modules or groups...",
+      "emptyModules": "No modules are activated for this tenant yet. Activate a module under Modules first.",
+      "emptyModulesLink": "Go to Modules",
+      "adminNote": "ADMIN and SUPER_ADMIN always have access to all active modules — this matrix only applies to the USER role.",
+      "saveError": "Could not save grant. Please try again."
+    },
+    "activationDialog": {
+      "title": "Activate Module: {module}",
+      "body": "Should the default group get immediate access to this module, or would you rather configure grants separately?",
+      "grantNow": "Grant Now",
+      "configureLater": "Configure Later",
+      "cancel": "Cancel",
+      "noDefaultGroupHint": "No default group marked — set one under Groups first or configure access manually."
+    }
   },
   "theme": {
     "light": "Light",
@@ -387,7 +465,12 @@
     "backToCategory": "Back to category",
     "allModules": "Modules",
     "allModulesDescription": "Available modules for your tenant",
-    "noActiveModules": "No modules activated. Ask your administrator to enable modules."
+    "noActiveModules": "No modules activated. Ask your administrator to enable modules.",
+    "accessDenied": {
+      "title": "No Access to This Module",
+      "body": "You do not have access to this module. Please contact your administrator.",
+      "backToDashboard": "Back to Dashboard"
+    }
   },
   "domaincheck": {
     "title": "Domain Check",
@@ -521,7 +604,9 @@
     "detailVersion": "Version {version}",
     "detailStatusActive": "Activated for this tenant",
     "detailStatusInactive": "Not activated",
-    "accessDenied": "Access denied"
+    "accessDenied": "Access denied",
+    "statusNoAccess": "No Access",
+    "toastNoAccess": "No access to this module — please contact your administrator."
   },
   "certManager": {
     "title": "Certificate Manager",