refactor: Clean Architecture mit Repository Pattern, Controllern und DTOs

- 15 Controller-Klassen ersetzen Minimal APIs in Program.cs
- Repository Pattern mit Interfaces + Implementierungen (Project, Task, Activity, User)
- AuthService verwendet jetzt IUserRepository statt direktem DbContext-Zugriff
- SecurityHeadersMiddleware als eigenständige Middleware-Klasse
- PathSecurityHelper als gemeinsamer Helper für Pfadvalidierung
- DTOs in eigenem Namespace Nexus.Api.DTOs
- EF-Entities in Nexus.Api.Data (vorher Nexus.Api.Domain)
- Program.cs auf DI-Registrierung + Middleware reduziert
- Alle 43 Endpoints unverändert erhalten
- Build + 3/3 Tests erfolgreich

backend/Repositories/IUserRepository.cs

@@ -0,0 +1,21 @@
+using Nexus.Api.Data;
+
+namespace Nexus.Api.Repositories;
+
+public interface IUserRepository
+{
+    ValueTask<NexusUser?> GetByIdAsync(Guid userId, CancellationToken ct = default);
+    Task<NexusUser?> GetByEmailAsync(string normalizedEmail, CancellationToken ct = default);
+    Task<bool> AnyUsersAsync(CancellationToken ct = default);
+    Task<NexusUser> AddAsync(NexusUser user, CancellationToken ct = default);
+    Task UpdateAsync(NexusUser user, CancellationToken ct = default);
+
+    // Refresh token operations
+    Task<RefreshToken?> GetRefreshTokenByHashAsync(string tokenHash, CancellationToken ct = default);
+    Task<List<RefreshToken>> GetActiveTokensByFamilyAsync(Guid familyId, CancellationToken ct = default);
+    Task AddRefreshTokenAsync(RefreshToken token, CancellationToken ct = default);
+    Task UpdateRefreshTokenAsync(RefreshToken token, CancellationToken ct = default);
+    Task RemoveExpiredTokensAsync(Guid userId, CancellationToken ct = default);
+
+    Task SaveChangesAsync(CancellationToken ct = default);
+}