Phase 8: CSV + ICS export, print view, MkDocs docs, SBOM + dev-mode auth

Auth (Test-Mode):
  - middleware.AuthMiddleware now takes a devMode flag. In dev,
    requests without Authorization fall back to a deterministic dev
    UUID (00000000-...-001) and role=teacher. ENVIRONMENT=production
    re-enables the strict 401 path.
  - main.go wires devMode = cfg.Environment != "production".
  - page.tsx replaces the red 'Anmeldung noch nicht integriert' banner
    with a softer Testumgebung notice; the manual-token form moves
    behind a nested details block.

Export endpoints (school-service):
  - LoadExportLessons joins tt_lesson with tt_period for wall-clock
    times; one query feeds both CSV and ICS.
  - WriteCSV streams 10 columns including pinned flag.
  - WriteICS emits one VEVENT per lesson anchored to a Monday — caller
    overridable via ?start=YYYY-MM-DD. RFC 5545 escapes for ',', ';',
    '\n' in icsEscape().
  - NextMonday helper for the default anchor.
  - GET /timetable/solutions/:id/export.{csv,ics} handlers attach
    Content-Disposition: attachment so browsers download instead of
    rendering.

Frontend:
  - lib/stundenplan/api.ts downloadSolutionExport() fetches as blob,
    triggers a synthetic <a download> click, and forwards the JWT when
    present.
  - PlanView gains CSV / ICS / Drucken buttons next to the perspective
    selector. The toolbar carries class 'no-print' so window.print()
    yields only the grid.
  - globals.css @media print rule hides chrome, forces white
    background, gives the table proper borders for A4.

Docs:
  - docs-src/services/stundenplan/{index,architecture,constraints,
    solver-tuning,export}.md with nav entry in mkdocs.yml under
    Services → Stundenplaner.
  - sbom/stundenplan/README.md lists manually-verified key dependencies
    and the policy reference. scripts/stundenplan-sbom.sh generates
    full machine-readable inventories via go-licenses + pip-licenses
    + license-checker when those tools are available.

Tests:
  - internal/services/timetable_exports_test.go: 4 unit tests covering
    CSV column layout + quoting, ICS structure + DTSTART formatting,
    icsEscape special chars, NextMonday weekday math.
  - studio-v2/e2e/stundenplan-export.spec.ts split out of the main spec
    file (LOC budget) — 3 tests for button render, CSV download,
    ICS download.
  - mockSchoolApi extended with export.csv + export.ics routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs-src/services/stundenplan/export.md

@@ -0,0 +1,72 @@
+# Export
+
+Drei Export-Formate fuer fertige Solutions, alle als GET-Endpoints im
+school-service.
+
+## CSV
+
+```
+GET /api/v1/school/timetable/solutions/{id}/export.csv
+Content-Type: text/csv; charset=utf-8
+```
+
+Spalten: `day_of_week,period_index,start_time,end_time,class,subject,
+subject_code,teacher,room,pinned`.
+
+Komma in Feldwerten (z.B. „Schmidt, Anna") wird automatisch escaped.
+Sortierung: by `(day_of_week, period_index, class_name)`.
+
+Anwendungsfaelle:
+- Import in Excel oder Google Sheets fuer Reports
+- Datenuebergabe an externes Schulverwaltungs-System
+- Datenarchivierung pro Schuljahr
+
+## ICS (iCalendar, RFC 5545)
+
+```
+GET /api/v1/school/timetable/solutions/{id}/export.ics
+GET /api/v1/school/timetable/solutions/{id}/export.ics?start=2026-08-24
+Content-Type: text/calendar; charset=utf-8
+```
+
+Emittiert ein VEVENT pro Lesson, anchored auf die naechste Montag-Woche
+(oder via `?start=YYYY-MM-DD` ueberschreibbar). Lehrer kann die Datei
+direkt im Apple Calendar, Google Calendar oder Outlook importieren.
+
+Strukturbeispiel:
+```
+BEGIN:VCALENDAR
+VERSION:2.0
+PRODID:-//BreakPilot//Timetable//DE
+BEGIN:VEVENT
+UID:lesson-0-d1p1-20260824@breakpilot
+DTSTAMP:20260522T144800Z
+DTSTART:20260824T080000
+DTEND:20260824T084500
+SUMMARY:Mathe (5a)
+LOCATION:A101
+DESCRIPTION:Lehrer: Schmidt, Anna\nSchuljahr 26/27
+END:VEVENT
+...
+END:VCALENDAR
+```
+
+**Aktuell nur eine Kalender-Woche** — fuer ganzes Schuljahr braeuchte es
+RRULE + Ferien-Exceptions, ist als Phase 9 vorgemerkt.
+
+## Drucken (HTML print view)
+
+Im PlanView gibt es einen „Drucken"-Button. Der Druck-Dialog des Browsers
+oeffnet sich; eigene `@media print`-Stylesheet in `globals.css` blendet
+Sidebar, Tabs, Help-Panel und Token-Banner aus und zwingt das Wochengrid auf
+weisses A4-Format.
+
+Vorteil ueber serverseitiges PDF: kein zusaetzliches Backend-Tool, keine
+Headless-Browser-Container, der User waehlt selbst Drucker/PDF/Format.
+
+## Aufruf vom Frontend
+
+`lib/stundenplan/api.ts:downloadSolutionExport(solutionId, 'csv' | 'ics')`
+laedt das Blob ueber den Next.js-Proxy, sodass der JWT (falls gesetzt) im
+Authorization-Header weitergegeben wird. Im Dev-Mode ohne Token funktioniert
+es ebenfalls.