fix: Restore all files lost during destructive rebase

A previous `git pull --rebase origin main` dropped 177 local commits,
losing 3400+ files across admin-v2, backend, studio-v2, website,
klausur-service, and many other services. The partial restore attempt
(660295e2) only recovered some files.

This commit restores all missing files from pre-rebase ref 98933f5e
while preserving post-rebase additions (night-scheduler, night-mode UI,
NightModeWidget dashboard integration).

Restored features include:
- AI Module Sidebar (FAB), OCR Labeling, OCR Compare
- GPU Dashboard, RAG Pipeline, Magic Help
- Klausur-Korrektur (8 files), Abitur-Archiv (5+ files)
- Companion, Zeugnisse-Crawler, Screen Flow
- Full backend, studio-v2, website, klausur-service
- All compliance SDKs, agent-core, voice-service
- CI/CD configs, documentation, scripts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

klausur-service/backend/services/auth_service.py

@@ -0,0 +1,46 @@
+"""
+Klausur-Service Authentication Service
+
+Functions for JWT authentication and user extraction.
+"""
+
+from typing import Dict
+import jwt
+
+from fastapi import HTTPException, Request
+
+from config import JWT_SECRET, ENVIRONMENT
+
+
+def get_current_user(request: Request) -> Dict:
+    """
+    Extract user from JWT token.
+
+    Args:
+        request: FastAPI Request object
+
+    Returns:
+        User payload dict containing user_id, role, email, etc.
+
+    Raises:
+        HTTPException: If token is missing, expired, or invalid
+    """
+    auth_header = request.headers.get("Authorization", "")
+
+    if not auth_header.startswith("Bearer "):
+        if ENVIRONMENT == "development":
+            return {
+                "user_id": "demo-teacher",
+                "role": "admin",
+                "email": "demo@breakpilot.app"
+            }
+        raise HTTPException(status_code=401, detail="Missing authorization header")
+
+    token = auth_header.replace("Bearer ", "")
+    try:
+        payload = jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+        return payload
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(status_code=401, detail="Token expired")
+    except jwt.InvalidTokenError:
+        raise HTTPException(status_code=401, detail="Invalid token")