feat: dashboard widgets, auth fix, profile names, dynamic groups

- Add VehicleDashboardCard: self-contained widget modelled after
  AtemschutzDashboardCard, shows einsatzbereit ratio and inspection
  warnings inline; replaces StatsCard + InspectionAlerts in Dashboard

- Add EquipmentDashboardCard: consolidated equipment status widget
  showing only aggregated counts (no per-item listing); replaces
  EquipmentAlerts component in Dashboard

- Fix auth race condition: add authInitialized flag to api.ts so 401
  responses during initial token validation no longer trigger a
  spurious redirect to /login; save intended destination before login
  redirect and restore it after successful auth callback

- Fix profile firstname/lastname: add extractNames() helper to
  auth.controller.ts that falls back to splitting userinfo.name when
  Authentik does not provide separate given_name/family_name fields;
  applied on both create and update paths

- Dynamic groups endpoint: replace hardcoded KNOWN_GROUPS array in
  events.controller.ts with a DB query (SELECT DISTINCT unnest
  (authentik_groups) FROM users); known slugs get German labels via
  lookup map, unknown slugs are humanized automatically

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/auth/LoginCallback.tsx

@@ -30,8 +30,10 @@ const LoginCallback: React.FC = () => {
 
       try {
         await login(code);
-        // Redirect to dashboard on success
-        navigate('/dashboard', { replace: true });
+        // Navigate to the originally intended page, falling back to the dashboard
+        const from = sessionStorage.getItem('auth_redirect_from') || '/dashboard';
+        sessionStorage.removeItem('auth_redirect_from');
+        navigate(from, { replace: true });
       } catch (err) {
         console.error('Login callback error:', err);
         const is429 = err && typeof err === 'object' && 'status' in err && (err as any).status === 429;

frontend/src/components/auth/ProtectedRoute.tsx

@@ -33,7 +33,7 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
 
   // If not authenticated, redirect to login
   if (!isAuthenticated) {
-    return <Navigate to="/login" replace />;
+    return <Navigate to="/login" replace state={{ from: window.location.pathname + window.location.search }} />;
   }
 
   // User is authenticated, render children