refactor(big-bang): cards → wordeck im gesamten Code-Layer

Phase 2 des cards→wordeck Big-Bang-Rebrand:

- 4 package.json: @cards/* → @wordeck/*
- packages/cards-domain/ → packages/wordeck-domain/
- 41+12 Files: from '@cards/domain' → '@wordeck/domain'
- pgSchema('cards') → pgSchema('wordeck') (Drizzle-Schema)
- 17 Files: process.env.CARDS_* → process.env.WORDECK_*
- docker-compose Service-Names: cards-* → wordeck-*
- docker-compose Volume: /Volumes/ManaData/cards → wordeck
- env-vars in compose: CARDS_DB_PASSWORD/_API_VERSION/_DSGVO_SERVICE_KEY etc. → WORDECK_*
- Log-Prefixes + Error-Strings + manifest-id 'cards' → 'wordeck'
- CORS-Origin cardecky.mana.how → wordeck.com
- .env.production.example umbenannt + S3-Key entfernt (kein MinIO mehr)

Type-Check 0 Errors in api+domain+web, 51/51 Domain-Tests grün.

DB-Rename + Container/Volume-Rename auf mana-server folgen in nächstem
Commit nach Verzeichnis-Rename.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/tests/setup.ts

@@ -4,6 +4,6 @@
 // Aktiviert den X-User-Id-Dev-Stub für Tests, weil die Suiten ohne
 // echten mana-auth-JWKS laufen. In Produktion ist der Stub fail-secure
 // AUS (siehe apps/api/src/middleware/auth.ts).
-if (process.env.CARDS_AUTH_DEV_STUB === undefined) {
-	process.env.CARDS_AUTH_DEV_STUB = 'true';
+if (process.env.WORDECK_AUTH_DEV_STUB === undefined) {
+	process.env.WORDECK_AUTH_DEV_STUB = 'true';
 }