Initial commit: everythingbutwork MVP

Internes Project-Management-Tool für ToolCTRL — ergänzend zu Plane (Tickets)
und Outline (Doku). Umfasst Puls-Übersicht, Tagesrhythmus (Lock-in + Reflexion),
Bereichs-Detail-Views (Entwicklung/Vertrieb/Marketing), Pflicht-Minimum-Check
und Blocker-Lifecycle gemäß Projektmanagement-Leitfaden v3.0.

Stack: pnpm-Monorepo · Vite + React 18 + Tailwind · Fastify + tRPC v11 +
Drizzle ORM · Postgres 16 · Authentik OIDC (Phase 2, Dev-Auto-Login aktiv).

Planungs-Artefakte unter _bmad-output/planning-artifacts/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/auth/middleware.ts

@@ -0,0 +1,25 @@
+// Fastify-Decorator: macht `req.cockpitUser` verfügbar, wenn die Session gültig ist.
+// Die Typaugmentation lebt in `../types.ts`, damit sie auch in tRPC-Imports
+// gezogen wird (web → api Type-Only-Import).
+
+import '../types.js';
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { loadEnv } from '../env.js';
+import { getSessionWithUser } from './session.js';
+
+export async function registerAuthMiddleware(app: FastifyInstance): Promise<void> {
+  const env = loadEnv();
+
+  app.decorateRequest('cockpitUser', null);
+  app.decorateRequest('cockpitSessionId', null);
+
+  app.addHook('onRequest', async (req: FastifyRequest) => {
+    const sessionId = req.cookies[env.SESSION_COOKIE_NAME];
+    if (!sessionId) return;
+    const found = await getSessionWithUser(sessionId);
+    if (found) {
+      req.cockpitUser = found.user;
+      req.cockpitSessionId = sessionId;
+    }
+  });
+}