feat(02-02): user CRUD API + admin page, tenant CRUD API + admin page

- Create UserController with GET/POST/PATCH/DELETE endpoints at /users
  - ADMIN sees own-tenant users only; SUPER_ADMIN sees all (T-02-10)
  - ADMIN cannot escalate to SUPER_ADMIN role (T-02-08)
  - ADMIN cannot delete self or cross-tenant users
- Create TenantController with GET/POST/PATCH/DELETE at /tenants
  - SUPER_ADMIN-only access (D-10)
  - Tenant deletion blocked if active users exist (T-02-09)
- Create CreateUserDto, UpdateUserDto, CreateTenantDto with class-validator
- Create admin/users page with user table, create/edit/delete modals
- Create admin/tenants page with tenant table, create/edit/deactivate (SUPER_ADMIN only)
- Add admin section to sidebar: Verwaltung > Benutzer + Mandanten
  - Verwaltung visible for ADMIN/SUPER_ADMIN; Tenants link SUPER_ADMIN only
- Install @nestjs/mapped-types for PartialType DTO pattern

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/tenant/dto/create-tenant.dto.ts

@@ -0,0 +1,14 @@
+import { IsNotEmpty, IsString, Matches } from 'class-validator';
+
+export class CreateTenantDto {
+  @IsString()
+  @IsNotEmpty()
+  name!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^[a-z0-9-]+$/, {
+    message: 'Slug must contain only lowercase letters, numbers, and hyphens',
+  })
+  slug!: string;
+}

apps/api/src/tenant/tenant.controller.ts

@@ -0,0 +1,150 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  Get,
+  NotFoundException,
+  Param,
+  Patch,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { Role } from '@prisma/client';
+import { Roles } from '../auth/decorators/roles.decorator';
+import { RolesGuard } from '../auth/guards/roles.guard';
+import { PrismaService } from '../prisma/prisma.service';
+import { CreateTenantDto } from './dto/create-tenant.dto';
+import { TenantService } from './tenant.service';
+
+/**
+ * Tenant CRUD controller.
+ * D-10: Only Super-Admin can manage tenants.
+ * T-02-09: Tenant deletion blocked if active users exist.
+ */
+@Controller('tenants')
+@UseGuards(RolesGuard)
+@Roles(Role.SUPER_ADMIN)
+export class TenantController {
+  constructor(
+    private readonly tenantService: TenantService,
+    private readonly prisma: PrismaService,
+  ) {}
+
+  /**
+   * GET /tenants
+   * Returns all tenants with user count.
+   */
+  @Get()
+  async findAll() {
+    const tenants = await this.prisma.tenant.findMany({
+      include: {
+        _count: {
+          select: { users: true },
+        },
+      },
+      orderBy: { name: 'asc' },
+    });
+
+    return tenants.map((t) => ({
+      id: t.id,
+      name: t.name,
+      slug: t.slug,
+      isActive: t.isActive,
+      createdAt: t.createdAt,
+      userCount: t._count.users,
+    }));
+  }
+
+  /**
+   * GET /tenants/:id
+   * Returns single tenant with user count.
+   */
+  @Get(':id')
+  async findOne(@Param('id') id: string) {
+    const tenant = await this.prisma.tenant.findUnique({
+      where: { id },
+      include: {
+        _count: {
+          select: { users: true },
+        },
+      },
+    });
+
+    if (!tenant) {
+      throw new NotFoundException('Tenant not found');
+    }
+
+    return {
+      id: tenant.id,
+      name: tenant.name,
+      slug: tenant.slug,
+      isActive: tenant.isActive,
+      createdAt: tenant.createdAt,
+      userCount: tenant._count.users,
+    };
+  }
+
+  /**
+   * POST /tenants
+   * Create a new tenant.
+   */
+  @Post()
+  async create(@Body() dto: CreateTenantDto) {
+    return this.tenantService.create({
+      name: dto.name,
+      slug: dto.slug,
+    });
+  }
+
+  /**
+   * PATCH /tenants/:id
+   * Update tenant name or isActive.
+   */
+  @Patch(':id')
+  async update(
+    @Param('id') id: string,
+    @Body() dto: { name?: string; isActive?: boolean },
+  ) {
+    const existing = await this.tenantService.findById(id);
+    if (!existing) {
+      throw new NotFoundException('Tenant not found');
+    }
+
+    return this.tenantService.update(id, {
+      name: dto.name,
+      isActive: dto.isActive,
+    });
+  }
+
+  /**
+   * DELETE /tenants/:id
+   * T-02-09: Only delete if no active users exist.
+   */
+  @Delete(':id')
+  async remove(@Param('id') id: string) {
+    const tenant = await this.prisma.tenant.findUnique({
+      where: { id },
+      include: {
+        _count: {
+          select: {
+            users: { where: { isActive: true } },
+          },
+        },
+      },
+    });
+
+    if (!tenant) {
+      throw new NotFoundException('Tenant not found');
+    }
+
+    if (tenant._count.users > 0) {
+      throw new BadRequestException(
+        'Cannot delete tenant with active users. Deactivate or reassign users first.',
+      );
+    }
+
+    await this.prisma.tenant.delete({ where: { id } });
+    return { message: 'Tenant deleted' };
+  }
+}

apps/api/src/tenant/tenant.module.ts

@@ -1,7 +1,9 @@
 import { Module } from '@nestjs/common';
+import { TenantController } from './tenant.controller';
 import { TenantService } from './tenant.service';
 
 @Module({
+  controllers: [TenantController],
   providers: [TenantService],
   exports: [TenantService],
 })