feat: Tageskontingent und Notfall-Eskalation (#6)

- Quota (app/quota.py): Anfragen pro Nutzer/Tag (usage-Tabelle), DAILY_REQUEST_LIMIT,
  pro Nutzer via prefs uebersteuerbar; 429 (REST) bzw. error-Event (WS); Metrik
- Notfall (app/safety/emergency.py): heuristische Erkennung (de/en); Log im Store
  (emergency_events) + optionaler Webhook (best-effort) + X-Emergency/emergency-Event;
  Metrik emergency_total; Notfaelle umgehen das Kontingent
- verdrahtet in chat/speak/transcribe + WS-Turns
- Tests: 64 gruen (+6); Doku aktualisiert (README, BEDIENUNGSANLEITUNG, Architektur, .env.example)

Hinweis: Notfall-Erkennung ist eine Heuristik (kein Lebensretter); erkannte Texte
sind sensibel -> DSGVO beachten.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/chat.py

@@ -13,6 +13,8 @@ from app.dependencies import (
     resolve_output_endpoint,
     get_store,
 )
+from app.quota import enforce_quota, record_usage, QuotaExceededError
+from app.safety.emergency import handle_emergency
 from app.schemas import ChatRequest
 
 router = APIRouter()
@@ -77,6 +79,15 @@ async def chat(
         )
         llm_context = [{"role": "system", "content": memory_text}] + llm_context
 
+    # Notfall-Erkennung zuerst (immer eskalieren, auch bei Quota-Limit).
+    emergency = handle_emergency(user, payload.text, store)
+
+    if emergency is None:
+        try:
+            enforce_quota(user, store)
+        except QuotaExceededError as exc:
+            raise HTTPException(status_code=429, detail=str(exc))
+
     try:
         trace, audio = await orchestrator.chat_text(
             payload.text,
@@ -88,6 +99,8 @@ async def chat(
     except Exception as exc:
         raise HTTPException(status_code=502, detail=str(exc))
 
+    record_usage(user, store, len(payload.text) + len(trace.semantic_response or ""))
+
     # Turn persistieren (User-Eingabe + semantische Antwort) fuer das Gedaechtnis.
     if session_id:
         store.append_message(session_id, user.id, "user", payload.text)
@@ -101,6 +114,7 @@ async def chat(
                 "route": route.as_dict(),
                 "history_len": len(conversation),
                 "memories_len": len(memories),
+                "emergency": emergency,
                 "trace": {
                     "raw_transcript": trace.raw_transcript,
                     "cleaned_transcript": trace.cleaned_transcript,
@@ -119,4 +133,6 @@ async def chat(
         "X-Audio-Sample-Width": "16",
         **_route_headers(route),
     }
+    if emergency:
+        headers["X-Emergency"] = emergency["category"]
     return StreamingResponse(BytesIO(audio), media_type="audio/pcm", headers=headers)

app/api/speak.py

@@ -11,7 +11,9 @@ from app.dependencies import (
     resolve_route,
     build_orchestrator,
     resolve_output_endpoint,
+    get_store,
 )
+from app.quota import enforce_quota, record_usage, QuotaExceededError
 from app.schemas import SpeakRequest
 
 router = APIRouter()
@@ -42,6 +44,12 @@ async def speak(
     except RoutingError as exc:
         raise HTTPException(status_code=422, detail=str(exc))
 
+    store = get_store()
+    try:
+        enforce_quota(user, store)
+    except QuotaExceededError as exc:
+        raise HTTPException(status_code=429, detail=str(exc))
+
     try:
         audio = await orchestrator.speak_only(
             payload.text,
@@ -49,6 +57,7 @@ async def speak(
             language=route.language,
             output=output,
         )
+        record_usage(user, store, len(payload.text))
 
         headers = {
             "Content-Language": route.language,

app/api/transcribe.py

@@ -7,7 +7,9 @@ from app.dependencies import (
     resolve_route,
     build_orchestrator,
     resolve_input_endpoint,
+    get_store,
 )
+from app.quota import enforce_quota, record_usage, QuotaExceededError
 
 router = APIRouter()
 
@@ -39,6 +41,12 @@ async def transcribe(
     except RoutingError as exc:
         raise HTTPException(status_code=422, detail=str(exc))
 
+    store = get_store()
+    try:
+        enforce_quota(user, store)
+    except QuotaExceededError as exc:
+        raise HTTPException(status_code=429, detail=str(exc))
+
     content = await file.read()
     suffix = (file.filename or "audio.wav").rsplit(".", 1)[-1].lower()
 
@@ -52,4 +60,6 @@ async def transcribe(
     except Exception as exc:
         raise HTTPException(status_code=502, detail=str(exc))
 
+    record_usage(user, store, len(trace.raw_transcript or ""))
+
     return {"route": route.as_dict(), "trace": trace.model_dump()}

app/api/ws.py

@@ -29,6 +29,8 @@ from app.dependencies import (
 )
 from app.store import SessionOwnershipError
 from app.audio.vad import EnergyVAD
+from app.quota import enforce_quota, record_usage, QuotaExceededError
+from app.safety.emergency import handle_emergency
 
 router = APIRouter()
 
@@ -75,6 +77,17 @@ async def _run_turn(websocket, store, user, session_id, route, orchestrator, out
         )
         llm_context = [{"role": "system", "content": memory_text}] + llm_context
 
+    # Notfall-Erkennung zuerst (immer eskalieren, auch bei Quota-Limit).
+    emergency = handle_emergency(user, text, store)
+    if emergency:
+        await websocket.send_json({"type": "emergency", "category": emergency["category"]})
+    else:
+        try:
+            enforce_quota(user, store)
+        except QuotaExceededError as exc:
+            await websocket.send_json({"type": "error", "status": 429, "detail": str(exc)})
+            return
+
     await websocket.send_json({"type": "ack", "route": route.as_dict()})
 
     voice = options.get("voice") or settings.openrouter_tts_voice
@@ -119,6 +132,8 @@ async def _run_turn(websocket, store, user, session_id, route, orchestrator, out
         await websocket.send_json({"type": "error", "status": 502, "detail": str(exc)})
         return
 
+    record_usage(user, store, len(text) + len(trace.semantic_response or ""))
+
     if session_id:
         store.append_message(session_id, user.id, "user", text)
         store.append_message(session_id, user.id, "assistant", trace.semantic_response)