Add full application: receipt scanning, auth, billing, and account deletion

Brings the working codebase (Next.js app, auth system, Stripe billing,
Docker/deploy config, tests, docs) into version control on top of the
placeholder initial commit, and adds account self-deletion (Danger Zone
in Settings, password + typed-email confirmation, cascading DB cleanup,
Stripe cancellation) per GDPR right-to-erasure.

Excludes local build caches, node_modules, and internal agent scratch
files; .gitignore hardened to keep those out going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/test_apple_searchads_api.mjs

@@ -0,0 +1,112 @@
+import crypto from 'crypto';
+import https from 'https';
+import fs from 'fs';
+
+// Read .env.local manually
+const envContent = fs.readFileSync('.env.local', 'utf8');
+const env = {};
+envContent.split('\n').forEach(line => {
+  const match = line.match(/^([^=]+)=(.*)$/);
+  if (match) {
+    let val = match[2].trim();
+    if (val.startsWith('"') && val.endsWith('"')) {
+      val = val.slice(1, -1);
+    }
+    env[match[1].trim()] = val;
+  }
+});
+
+const CLIENT_ID = env.APPLE_SEARCH_ADS_CLIENT_ID;
+const TEAM_ID = env.APPLE_SEARCH_ADS_TEAM_ID;
+const KEY_ID = env.APPLE_SEARCH_ADS_KEY_ID;
+const PRIVATE_KEY = env.APPLE_SEARCH_ADS_PRIVATE_KEY;
+
+function generateClientSecret() {
+  if (!PRIVATE_KEY || PRIVATE_KEY.trim() === '') {
+    throw new Error("APPLE_SEARCH_ADS_PRIVATE_KEY ist nicht in .env.local gesetzt!");
+  }
+
+  const header = {
+    alg: "ES256",
+    kid: KEY_ID,
+    typ: "JWT"
+  };
+
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: CLIENT_ID,
+    aud: "https://appleid.apple.com",
+    iat: now,
+    exp: now + 86400 * 180, // 180 Tage
+    iss: TEAM_ID
+  };
+
+  const base64Header = Buffer.from(JSON.stringify(header)).toString("base64url");
+  const base64Payload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const signingInput = `${base64Header}.${base64Payload}`;
+
+  const signer = crypto.createSign("SHA256");
+  signer.update(signingInput);
+  const formattedKey = PRIVATE_KEY.replace(/\\n/g, '\n');
+  const signature = signer.sign({
+    key: formattedKey,
+    dsaEncoding: 'ieee-p1363'
+  }, "base64url");
+
+  return `${signingInput}.${signature}`;
+}
+
+async function getAccessToken(clientSecret) {
+  return new Promise((resolve, reject) => {
+    const postData = new URLSearchParams({
+      grant_type: 'client_credentials',
+      client_id: CLIENT_ID,
+      client_secret: clientSecret,
+      scope: 'searchadsorg'
+    }).toString();
+
+    const options = {
+      hostname: 'appleid.apple.com',
+      port: 443,
+      path: '/auth/oauth2/token',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(postData),
+        'User-Agent': 'Mozilla/5.0'
+      }
+    };
+
+    const req = https.request(options, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        try {
+          resolve(JSON.parse(data));
+        } catch (e) {
+          reject(new Error(`Parse error: ${data}`));
+        }
+      });
+    });
+
+    req.on('error', reject);
+    req.write(postData);
+    req.end();
+  });
+}
+
+async function main() {
+  try {
+    console.log("1. Generiere Client Secret (JWT)...");
+    const clientSecret = generateClientSecret();
+    console.log("Client Secret erfolgreich generiert.");
+
+    console.log("2. Fordere Access Token bei Apple OAuth an...");
+    const tokenData = await getAccessToken(clientSecret);
+    console.log("Antwort von Apple:", tokenData);
+  } catch (err) {
+    console.error("Fehler:", err.message);
+  }
+}
+
+main();