feat: complete CMS v2 with Docker, Fischerei, Meetings, Verband modules + UX audit fixes

Major changes:
- Docker Compose: full Supabase stack (11 services) equivalent to supabase CLI
- Fischerei module: 16 DB tables, waters/species/stocking/catch books/competitions
- Sitzungsprotokolle module: meeting protocols, agenda items, task tracking
- Verbandsverwaltung module: federation management, member clubs, contacts, fees
- Per-account module activation via Modules page toggle
- Site Builder: live CMS data in Puck blocks (courses, events, membership registration)
- Public registration APIs: course signup, event registration, membership application
- Document generation: PDF member cards, Excel reports, HTML labels
- Landing page: real Com.BISS content (no filler text)
- UX audit fixes: AccountNotFound component, shared status badges, confirm dialog,
  pagination, duplicate heading removal, emoji→badge replacement, a11y fixes
- QA: healthcheck fix, API auth fix, enum mismatch fix, password required attribute

docker/db/zzz-role-passwords.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+set -e
+
+# ===========================================================================
+# Supabase role password bootstrap
+# 
+# Runs AFTER migrate.sh (zzz- prefix ensures alphabetical ordering).
+# By this point all roles exist (created by init-scripts/00000000000000-initial-schema.sql).
+# Sets passwords so PostgREST, Storage, Auth, and Studio can connect via TCP.
+# ===========================================================================
+
+psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -U supabase_admin -d postgres <<-EOSQL
+  -- PostgREST connects as authenticator
+  ALTER ROLE authenticator WITH LOGIN PASSWORD '${POSTGRES_PASSWORD}';
+
+  -- Storage API connects as supabase_storage_admin
+  ALTER ROLE supabase_storage_admin WITH LOGIN PASSWORD '${POSTGRES_PASSWORD}';
+
+  -- GoTrue (Auth) connects as supabase_auth_admin
+  ALTER ROLE supabase_auth_admin WITH LOGIN PASSWORD '${POSTGRES_PASSWORD}';
+
+  -- Studio / pg_meta connects as dashboard_user
+  ALTER ROLE dashboard_user WITH LOGIN PASSWORD '${POSTGRES_PASSWORD}';
+
+  -- postgres (created by migrate.sh, needs password for TCP auth)
+  ALTER ROLE postgres WITH PASSWORD '${POSTGRES_PASSWORD}';
+
+  -- Realtime needs the _realtime schema
+  CREATE SCHEMA IF NOT EXISTS _realtime;
+  GRANT ALL ON SCHEMA _realtime TO supabase_admin;
+  GRANT USAGE ON SCHEMA _realtime TO postgres, anon, authenticated, service_role;
+EOSQL
+
+echo "✅ All Supabase role passwords set successfully."