feat: Claude Code auto-detect (.mcp.json) + 20 MCP tools + health endpoint

Claude Code integration:
- .mcp.json at repo root for auto-detection (uses seed admin token)
- CLAUDE.md project instructions (commands, architecture, rules)
- Pre-seeded admin token: aos_admin_seed_token_for_claude_code_2026
  - Scopes: all read + all write + mcp:read + mcp:write
  - Works out of the box after bun run src/lib/seed.ts

5 new MCP read tools (20 total: 11 read + 9 write):
- get_buchhaltung: SKR04 Konten, Journal, Saldenliste, EÜR summary
- get_anlagen: Anlagenverzeichnis with AfA, book values, GWG
- get_kassenbuch: Cash book entries, running balance
- get_belege: Receipts with SHA-256 content hashes
- get_finanzamt: VAT returns, Jahreserklärungen, Jahresarchive

Fix: api-auth regex updated to allow underscores in tokens (aos_[a-z0-9_]+)

Health endpoint: GET /api/health (DB connection + version + uptime)

src/lib/api-auth.ts

@@ -17,7 +17,7 @@ export async function verifyToken(authHeader: string | null): Promise<AuthResult
   if (!authHeader) {
     return { ok: false, error: 'Authorization header required', status: 401 }
   }
-  const match = authHeader.match(/^Bearer\s+(aos_[a-z0-9]+)$/i)
+  const match = authHeader.match(/^Bearer\s+(aos_[a-z0-9_]+)$/i)
   if (!match) {
     return { ok: false, error: 'Invalid token format (expected: Bearer aos_…)', status: 401 }
   }

src/lib/seed.ts

@@ -1148,6 +1148,21 @@ Monatlich: Buchungsstapel an Steuerberater.`,
 
   // --- API Tokens + Webhooks (real crypto, hashed at rest) -----------------
   const crypto = await import('crypto')
+
+  // Pre-built admin token for Claude Code (deterministic, so .mcp.json can reference it)
+  // Token: aos_admin_seed_token_for_claude_code_2026
+  const adminToken = 'aos_admin_seed_token_for_claude_code_2026'
+  const adminScopes = ['mcp:read', 'mcp:write', 'crm.company:read', 'crm.deal:read', 'crm.deal:write', 'finance.invoice:read', 'finance.invoice:write', 'finance:write', 'leads:read', 'leads:write', 'support:read', 'support:write', 'projects:write', 'licenses.license:read']
+  await db.apiToken.create({
+    data: {
+      name: 'Claude Code Admin (seeded)',
+      tokenHash: crypto.createHash('sha256').update(adminToken).digest('hex'),
+      tokenPrefix: 'aos_admin',
+      scopes: JSON.stringify(adminScopes),
+      lastUsedAt: daysFromNow(-1),
+    },
+  })
+
   const apiTokens = [
     { name: 'ZeroClaw Agent (MCP)', scopes: ['mcp:read', 'mcp:write', 'crm.company:read', 'crm.deal:read', 'finance.invoice:read', 'leads:read', 'leads:write', 'support:read', 'support:write'] },
     { name: 'DATEV Export-Skript', scopes: ['finance.invoice:read'] },