K4: add Kassenwart role + policy

- UserRole.Treasurer = "Kassenwart"
- IdentityRoleSeeder: seed Kassenwart role
- ClubRoleRequirement: rank Admin=4, Kassenwart=3
- ClubTreasurer policy in DI

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/IMPLEMENTATION_PLAN.md

@@ -1702,7 +1702,7 @@ public enum CashBookEntryType { Income = 0, Expense = 1 }
 | ✓ | K1 | Domain | Entities + Enums | 5 |
 | ✓ | K2 | Infrastructure | EF Configurations | 4 |
 | ✓ | K3 | Infrastructure | Migration | - |
-| ☐ | K4 | Security | Kassenwart Role + Policy | 4 |
+| ✓ | K4 | Security | Kassenwart Role + Policy | 4 |
 | ☐ | K5 | Infrastructure | Repositories | 5 |
 | ☐ | K6 | Application | DTOs | 3 |
 | ☐ | K7 | Application | Service Interfaces | 2 |

src/Koogle.Domain/Enums/UserRole.cs

@@ -25,6 +25,12 @@ namespace Koogle.Domain.Enums
         /// </summary>
         public const string Admin = "Admin";
 
+        /// <summary>
+        /// With this role, the user can manage the cash book within a club.
+        /// Rank between Editor and Admin.
+        /// </summary>
+        public const string Treasurer = "Kassenwart";
+
         /// <summary>
         /// With this role, the user can edit content within a club but does not have administrative rights.
         /// </summary>

src/Koogle.Infrastructure/DependencyInjection.cs

@@ -74,6 +74,7 @@ public static class DependencyInjection
         {
             options.AddPolicy("ClubViewer", p => p.Requirements.Add(new ClubRoleRequirement("Viewer")));
             options.AddPolicy("ClubEditor", p => p.Requirements.Add(new ClubRoleRequirement("Editor")));
+            options.AddPolicy("ClubTreasurer", p => p.Requirements.Add(new ClubRoleRequirement("Kassenwart")));
             options.AddPolicy("ClubAdmin", p => p.Requirements.Add(new ClubRoleRequirement("Admin")));
         });
         services.AddSingleton<IAuthorizationHandler, ClubRoleHandler>();

src/Koogle.Infrastructure/Security/ClubRoleRequirement.cs

@@ -16,7 +16,8 @@ public static class ClubRoleHelper
     {
         static int Rank(string role) => role switch
         {
-            "Admin" => 3,
+            "Admin" => 4,
+            "Kassenwart" => 3,
             "Editor" => 2,
             "Viewer" => 1,
             _ => 0

src/Koogle.Infrastructure/Security/IdentityRoleSeeder.cs

@@ -16,7 +16,7 @@ public static class IdentityRoleSeeder
     {
         var roleManager = services.GetRequiredService<RoleManager<ApplicationRole>>();
 
-        string[] roles = { "SuperAdmin", "Admin", "Editor", "Viewer" };
+        string[] roles = { "SuperAdmin", "Admin", "Kassenwart", "Editor", "Viewer" };
 
         foreach (var roleName in roles)
         {