fix: Restore all files lost during destructive rebase

A previous `git pull --rebase origin main` dropped 177 local commits,
losing 3400+ files across admin-v2, backend, studio-v2, website,
klausur-service, and many other services. The partial restore attempt
(660295e2) only recovered some files.

This commit restores all missing files from pre-rebase ref 98933f5e
while preserving post-rebase additions (night-scheduler, night-mode UI,
NightModeWidget dashboard integration).

Restored features include:
- AI Module Sidebar (FAB), OCR Labeling, OCR Compare
- GPU Dashboard, RAG Pipeline, Magic Help
- Klausur-Korrektur (8 files), Abitur-Archiv (5+ files)
- Companion, Zeugnisse-Crawler, Screen Flow
- Full backend, studio-v2, website, klausur-service
- All compliance SDKs, agent-core, voice-service
- CI/CD configs, documentation, scripts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -0,0 +1,152 @@
+# Pre-commit Hooks für BreakPilot
+# Installation: pip install pre-commit && pre-commit install
+# Aktivierung: pre-commit install
+
+repos:
+  # Go Hooks
+  - repo: local
+    hooks:
+      - id: go-test
+        name: Go Tests
+        entry: bash -c 'cd consent-service && go test -short ./...'
+        language: system
+        pass_filenames: false
+        files: \.go$
+        stages: [commit]
+
+      - id: go-fmt
+        name: Go Format
+        entry: bash -c 'cd consent-service && gofmt -l -w .'
+        language: system
+        pass_filenames: false
+        files: \.go$
+        stages: [commit]
+
+      - id: go-vet
+        name: Go Vet
+        entry: bash -c 'cd consent-service && go vet ./...'
+        language: system
+        pass_filenames: false
+        files: \.go$
+        stages: [commit]
+
+      - id: golangci-lint
+        name: Go Lint (golangci-lint)
+        entry: bash -c 'cd consent-service && golangci-lint run --timeout=5m'
+        language: system
+        pass_filenames: false
+        files: \.go$
+        stages: [commit]
+
+  # Python Hooks
+  - repo: local
+    hooks:
+      - id: pytest
+        name: Python Tests
+        entry: bash -c 'cd backend && pytest -x'
+        language: system
+        pass_filenames: false
+        files: \.py$
+        stages: [commit]
+
+      - id: black
+        name: Black Format
+        entry: black
+        language: python
+        types: [python]
+        args: [--line-length=120]
+        stages: [commit]
+
+      - id: flake8
+        name: Flake8 Lint
+        entry: flake8
+        language: python
+        types: [python]
+        args: [--max-line-length=120, --exclude=venv]
+        stages: [commit]
+
+  # General Hooks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+        name: Trim Trailing Whitespace
+      - id: end-of-file-fixer
+        name: Fix End of Files
+      - id: check-yaml
+        name: Check YAML
+        args: [--allow-multiple-documents]
+      - id: check-json
+        name: Check JSON
+      - id: check-added-large-files
+        name: Check Large Files
+        args: [--maxkb=500]
+      - id: detect-private-key
+        name: Detect Private Keys
+      - id: mixed-line-ending
+        name: Fix Mixed Line Endings
+
+  # Security Checks
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.4.0
+    hooks:
+      - id: detect-secrets
+        name: Detect Secrets
+        args: ['--baseline', '.secrets.baseline']
+        exclude: |
+          (?x)^(
+            .*\.lock|
+            .*\.sum|
+            package-lock\.json
+          )$
+
+  # =============================================
+  # DevSecOps: Gitleaks (Secrets Detection)
+  # =============================================
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.1
+    hooks:
+      - id: gitleaks
+        name: Gitleaks (secrets detection)
+        entry: gitleaks protect --staged -v --config .gitleaks.toml
+        language: golang
+        pass_filenames: false
+
+  # =============================================
+  # DevSecOps: Semgrep (SAST)
+  # =============================================
+  - repo: https://github.com/returntocorp/semgrep
+    rev: v1.52.0
+    hooks:
+      - id: semgrep
+        name: Semgrep (SAST)
+        args:
+          - --config=auto
+          - --config=.semgrep.yml
+          - --severity=ERROR
+        types_or: [python, javascript, typescript, go]
+        stages: [commit]
+
+  # =============================================
+  # DevSecOps: Bandit (Python Security)
+  # =============================================
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.6
+    hooks:
+      - id: bandit
+        name: Bandit (Python security)
+        args: ["-r", "backend/", "-ll", "-x", "backend/tests/*"]
+        files: ^backend/.*\.py$
+        stages: [commit]
+
+  # Branch Protection
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: no-commit-to-branch
+        name: Protect main/develop branches
+        args: ['--branch', 'main', '--branch', 'develop']
+
+# Configuration
+default_stages: [commit]
+fail_fast: false