feat: Cloud-Fundament - Auth, Persistenz und Mandanten-Trennung

- SQLite-Store (app/store.py) hinter Store-Interface: Nutzer + Sessions persistent
- Bearer-Token-Auth (app/auth.py); Nutzerverwaltung via Admin-Key (POST /api/admin/users)
- GET /api/me, PUT /api/me/prefs (dauerhafte Nutzer-Praeferenzen)
- chat/speak/transcribe/sessions auth-geschuetzt; Mandanten-Trennung (fremde Session -> 403)
- Route-Aufloesung: Defaults < Profil < ENV < Nutzer-Prefs < Session < Request
- SessionManager (in-memory) durch Store ersetzt
- AUTH_ENABLED-Schalter (prod an, dev/Tests aus); DB_PATH/ADMIN_API_KEY
- Doku aktualisiert (README, BEDIENUNGSANLEITUNG, Architektur, deploy-env); data/ gitignored
- Tests: 29 gruen (Auth, Mandanten, Persistenz, Routing)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/conftest.py

@@ -1,16 +1,23 @@
 import pytest
 
 import app.dependencies as deps
+from app.config import settings
+from app.store import SQLiteStore
 
 
 @pytest.fixture(autouse=True)
-def reset_state():
-    """Isoliert den Singleton-Audio-Router (Loopback-Buffer) und Sessions je Test."""
+def reset_state(tmp_path, monkeypatch):
+    """Pro Test: frische SQLite-DB, frischer Singleton-Audio-Router, Auth aus.
+
+    Auth-Tests schalten `settings.auth_enabled` selbst wieder ein.
+    """
+    deps._store = SQLiteStore(str(tmp_path / "test.db"))
     deps._audio_router = None
-    deps.session_manager._sessions.clear()
+    monkeypatch.setattr(settings, "auth_enabled", False)
+    monkeypatch.setattr(settings, "admin_api_key", "")
     yield
+    deps._store = None
     deps._audio_router = None
-    deps.session_manager._sessions.clear()
 
 
 def loopback_output():

tests/test_auth.py

@@ -0,0 +1,91 @@
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.config import settings
+
+client = TestClient(app)
+
+ADMIN = "admin-secret"
+
+
+def _enable_auth(monkeypatch):
+    monkeypatch.setattr(settings, "auth_enabled", True)
+    monkeypatch.setattr(settings, "admin_api_key", ADMIN)
+
+
+def _create_user(name: str) -> str:
+    resp = client.post(
+        "/api/admin/users", headers={"X-Admin-Key": ADMIN}, json={"display_name": name}
+    )
+    assert resp.status_code == 200
+    return resp.json()["token"]
+
+
+def test_protected_endpoint_requires_token(monkeypatch):
+    _enable_auth(monkeypatch)
+    resp = client.post("/api/speak", json={"text": "x", "tts_provider": "piper"})
+    assert resp.status_code == 401
+
+
+def test_admin_requires_key(monkeypatch):
+    _enable_auth(monkeypatch)
+    resp = client.post("/api/admin/users", json={"display_name": "Anna"})
+    assert resp.status_code == 401
+
+
+def test_create_user_and_call_me(monkeypatch):
+    _enable_auth(monkeypatch)
+    token = _create_user("Anna")
+    auth = {"Authorization": f"Bearer {token}"}
+
+    me = client.get("/api/me", headers=auth)
+    assert me.status_code == 200
+    assert me.json()["display_name"] == "Anna"
+
+    bad = client.get("/api/me", headers={"Authorization": "Bearer nope"})
+    assert bad.status_code == 401
+
+
+def test_tenant_isolation_returns_403(monkeypatch):
+    _enable_auth(monkeypatch)
+    token_a = _create_user("A")
+    token_b = _create_user("B")
+
+    client.post(
+        "/api/sessions/shared/route",
+        headers={"Authorization": f"Bearer {token_a}"},
+        json={"tts_provider": "piper"},
+    )
+    # B versucht die Session von A zu nutzen.
+    resp = client.post(
+        "/api/speak?session_id=shared",
+        headers={"Authorization": f"Bearer {token_b}"},
+        json={"text": "x"},
+    )
+    assert resp.status_code == 403
+
+
+def test_user_prefs_applied_to_route(monkeypatch):
+    _enable_auth(monkeypatch)
+    token = _create_user("Pref")
+    auth = {"Authorization": f"Bearer {token}"}
+
+    client.put(
+        "/api/me/prefs",
+        headers=auth,
+        json={"tts_provider": "piper", "output_endpoint": "loopback"},
+    )
+    resp = client.post("/api/speak", headers=auth, json={"text": "hallo"})
+    assert resp.status_code == 200
+    assert resp.headers["X-TTS-Provider"] == "piper"
+    assert resp.headers["X-Output-Endpoint"] == "loopback"
+
+
+def test_admin_unconfigured_returns_503(monkeypatch):
+    # Auth an, aber kein Admin-Key gesetzt.
+    monkeypatch.setattr(settings, "auth_enabled", True)
+    monkeypatch.setattr(settings, "admin_api_key", "")
+    resp = client.post(
+        "/api/admin/users", headers={"X-Admin-Key": "irgendwas"}, json={"display_name": "X"}
+    )
+    assert resp.status_code == 503

tests/test_routing.py

@@ -2,11 +2,12 @@ import pytest
 
 from app.config import Settings
 from app.errors import UnknownComponentError
+from app.store import SessionOwnershipError
 from app.dependencies import (
     resolve_route,
     get_llm_provider,
     get_tts_provider,
-    session_manager,
+    get_store,
 )
 
 
@@ -25,16 +26,35 @@ def test_request_overrides_win():
     assert route.output_endpoint == "loopback"
 
 
-def test_session_then_request_precedence():
-    session_manager.update("s_test", {"tts_provider": "piper", "language": "en"})
-    route = resolve_route("s_test")
-    assert route.tts_provider == "piper"
+def test_user_prefs_session_request_precedence():
+    store = get_store()
+    user, _ = store.create_user("Tester")
+    store.set_user_prefs(user.id, {"tts_provider": "chatterbox", "language": "en"})
+    user = store.get_user(user.id)
+
+    # Nutzer-Prefs gelten.
+    route = resolve_route(user)
+    assert route.tts_provider == "chatterbox"
     assert route.language == "en"
 
-    # Request schlaegt Session.
-    route2 = resolve_route("s_test", {"tts_provider": "chatterbox"})
-    assert route2.tts_provider == "chatterbox"
-    assert route2.language == "en"
+    # Session schlägt Nutzer-Prefs.
+    store.update_session("s1", user.id, {"tts_provider": "piper"})
+    route2 = resolve_route(user, "s1")
+    assert route2.tts_provider == "piper"
+    assert route2.language == "en"  # weiterhin aus den Nutzer-Prefs
+
+    # Request schlägt Session.
+    route3 = resolve_route(user, "s1", {"tts_provider": "openrouter"})
+    assert route3.tts_provider == "openrouter"
+
+
+def test_session_ownership_enforced_in_route():
+    store = get_store()
+    owner, _ = store.create_user("A")
+    other, _ = store.create_user("B")
+    store.update_session("shared", owner.id, {"tts_provider": "piper"})
+    with pytest.raises(SessionOwnershipError):
+        resolve_route(other, "shared")
 
 
 def test_registry_unknown_provider_raises():