Initial: Rust-Backend mit Clean Architecture (domain/application/infrastructure/api)

Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
  Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
  utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
  DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
  Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
  AuthenticatedUser-Extractor.

Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
  /deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}

Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
  scan_audit mit clientScanId-UNIQUE, state_reason refactor,
  delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.

Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
  (PN 1001) + Audience-/Personalnummer-Mapper

crates/api/src/routes/accounts.rs

@@ -0,0 +1,44 @@
+use axum::Json;
+use axum::Router;
+use axum::extract::{Path, State};
+use axum::routing::get;
+use holzleitner_domain::Account;
+
+use crate::error::ApiError;
+use crate::extractors::AuthenticatedUser;
+use crate::state::AppState;
+
+pub fn router() -> Router<AppState> {
+    Router::new().route("/accounts/{personalnummer}", get(get_account))
+}
+
+/// Liest den Account zu einer Personalnummer.
+#[utoipa::path(
+    get,
+    path = "/accounts/{personalnummer}",
+    tag = "accounts",
+    params(
+        ("personalnummer" = i64, Path, description = "Personalnummer des Accounts")
+    ),
+    responses(
+        (status = 200, description = "Account gefunden", body = Account),
+        (status = 401, description = "Authentifizierung fehlgeschlagen"),
+        (status = 404, description = "Kein Account zu dieser Personalnummer")
+    ),
+    security(
+        ("bearer_auth" = [])
+    )
+)]
+pub async fn get_account(
+    State(state): State<AppState>,
+    AuthenticatedUser(claims): AuthenticatedUser,
+    Path(personalnummer): Path<i64>,
+) -> Result<Json<Account>, ApiError> {
+    tracing::debug!(
+        caller = claims.personalnummer,
+        target = personalnummer,
+        "get_account",
+    );
+    let account = state.get_account.execute(personalnummer).await?;
+    Ok(Json(account))
+}