feat: Cloud-Fundament - Auth, Persistenz und Mandanten-Trennung

- SQLite-Store (app/store.py) hinter Store-Interface: Nutzer + Sessions persistent
- Bearer-Token-Auth (app/auth.py); Nutzerverwaltung via Admin-Key (POST /api/admin/users)
- GET /api/me, PUT /api/me/prefs (dauerhafte Nutzer-Praeferenzen)
- chat/speak/transcribe/sessions auth-geschuetzt; Mandanten-Trennung (fremde Session -> 403)
- Route-Aufloesung: Defaults < Profil < ENV < Nutzer-Prefs < Session < Request
- SessionManager (in-memory) durch Store ersetzt
- AUTH_ENABLED-Schalter (prod an, dev/Tests aus); DB_PATH/ADMIN_API_KEY
- Doku aktualisiert (README, BEDIENUNGSANLEITUNG, Architektur, deploy-env); data/ gitignored
- Tests: 29 gruen (Auth, Mandanten, Persistenz, Routing)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_routing.py

@@ -2,11 +2,12 @@ import pytest
 
 from app.config import Settings
 from app.errors import UnknownComponentError
+from app.store import SessionOwnershipError
 from app.dependencies import (
     resolve_route,
     get_llm_provider,
     get_tts_provider,
-    session_manager,
+    get_store,
 )
 
 
@@ -25,16 +26,35 @@ def test_request_overrides_win():
     assert route.output_endpoint == "loopback"
 
 
-def test_session_then_request_precedence():
-    session_manager.update("s_test", {"tts_provider": "piper", "language": "en"})
-    route = resolve_route("s_test")
-    assert route.tts_provider == "piper"
+def test_user_prefs_session_request_precedence():
+    store = get_store()
+    user, _ = store.create_user("Tester")
+    store.set_user_prefs(user.id, {"tts_provider": "chatterbox", "language": "en"})
+    user = store.get_user(user.id)
+
+    # Nutzer-Prefs gelten.
+    route = resolve_route(user)
+    assert route.tts_provider == "chatterbox"
     assert route.language == "en"
 
-    # Request schlaegt Session.
-    route2 = resolve_route("s_test", {"tts_provider": "chatterbox"})
-    assert route2.tts_provider == "chatterbox"
-    assert route2.language == "en"
+    # Session schlägt Nutzer-Prefs.
+    store.update_session("s1", user.id, {"tts_provider": "piper"})
+    route2 = resolve_route(user, "s1")
+    assert route2.tts_provider == "piper"
+    assert route2.language == "en"  # weiterhin aus den Nutzer-Prefs
+
+    # Request schlägt Session.
+    route3 = resolve_route(user, "s1", {"tts_provider": "openrouter"})
+    assert route3.tts_provider == "openrouter"
+
+
+def test_session_ownership_enforced_in_route():
+    store = get_store()
+    owner, _ = store.create_user("A")
+    other, _ = store.create_user("B")
+    store.update_session("shared", owner.id, {"tts_provider": "piper"})
+    with pytest.raises(SessionOwnershipError):
+        resolve_route(other, "shared")
 
 
 def test_registry_unknown_provider_raises():