- Reworked the tenant admin login page

- Updated the User model to implement Filament’s tenancy contracts
- Seeded a ready-to-use demo tenant (user, tenant, active package, purchase)
- Introduced a branded, translated 403 error page to replace the generic forbidden message for unauthorised admin hits
- Removed the public “Register” links from the marketing header
- hardened join event logic and improved error handling in the guest pwa.

docs/prp/tenant-app-specs/capacitor-setup.md

@@ -121,9 +121,9 @@ packages/mobile/         # Shared Native-Config (optional)
   - **Privacy**: Usage Descriptions in Info.plist (z.B. "Kamera für QR-Scans").
 
 - **PWA-Fallback** (Web):
-  - **manifest.json**: `start_url: '/event-admin/'`, `display: 'standalone'`.
-  - **Service Worker**: Caching von Assets; Background Sync für Mutations.
-  - **Distribution**: Hosting auf `admin.fotospiel.app` mit A2HS-Prompt.
+  - **manifest.json**: liegt unter `public/manifest.json` (Scope `/event-admin/`, Theme-Farbe `#f43f5e`, Shortcuts für Welcome & Dashboard).
+  - **Service Worker**: `public/admin-sw.js` cached Shell + Assets, liefert Offline-Fallback `/event-admin` für Navigations-Anfragen.
+  - **Distribution**: Hosting auf `admin.fotospiel.app` mit A2HS-Prompt; Bubblewrap/TWA nutzt `https://admin.fotospiel.app/manifest.json`.
 
 ### Native Features (Erweiterung zu settings-config.md)
 - **Push-Notifications**: