feat(domain): add core entities — Club, Member, WorkItem, Shift with state machine

- Create domain entities in WorkClub.Domain/Entities: Club, Member, WorkItem, Shift, ShiftSignup
- Implement enums: SportType, ClubRole, WorkItemStatus
- Add ITenantEntity interface for multi-tenancy support
- Implement state machine validation on WorkItem with C# 14 switch expressions
- Valid transitions: Open→Assigned→InProgress→Review→Done, Review→InProgress (rework)
- All invalid transitions throw InvalidOperationException
- TDD approach: Write tests first, 12/12 passing
- Use required properties with explicit Guid/Guid? for foreign keys
- DateTimeOffset for timestamps (timezone-aware, multi-tenant friendly)
- RowVersion byte[] for optimistic concurrency control
- No navigation properties yet (deferred to EF Core task)
- No domain events or validation attributes (YAGNI for MVP)

.sisyphus/evidence/task-3-user-auth.txt

@@ -0,0 +1,15 @@
+Task 3 User Authentication Results
+===================================
+
+Docker environment not available - automated test deferred.
+
+CONFIGURATION VERIFIED:
+- Realm export JSON: VALID syntax
+- 5 test users configured with club memberships
+- 2 clients configured (workclub-api, workclub-app)
+- Custom protocol mapper configured for 'clubs' JWT claim
+
+To run verification once Docker is available:
+  ./infra/keycloak/test-auth.sh
+
+This script will authenticate all users and validate JWT claims.