feat(web): Remote-Web-UI mit Mikrofon + Forward-Auth (YunoHost-SSO)

- Minimale Web-UI (app/web/, vanilla, same-origin -> kein CORS): Text-Prompt +
  Mikrofon-Button (Aufnahme im Browser -> /ws/voice -> Antwort wird vorgelesen),
  Token-Streaming, PCM-Wiedergabe, Identitaet/Logout/Admin im Menue
- Forward-/Trusted-Header-Auth (app/auth.py): Identitaet aus SSO-Header, nur von
  TRUSTED_PROXY_IPS akzeptiert; sonst Token/Anonymous-Fallback. Auto-Provisioning
  via store.get_or_create_user_by_external_id (+ external_id-Spalte/Migration)
- /api/me um is_admin + sso_logout_url erweitert; GET /api/admin/users (Liste) und
  GET /api/admin/request-headers (SSO-Header-Discovery), Admin-gated
- StaticFiles-Mount; Config: TRUSTED_AUTH_HEADER/_PROXY_IPS, ADMIN_USERS, SSO_LOGOUT_URL
- WS-Auth liest Identitaet aus dem Handshake-Header
- Deploy: nginx-Vorlage (WS-Upgrade!) + deploy/README.md (HTTPS/SSO/Firewall/Discovery)
- Tests: Forward-Auth (Provisioning, Admin-Flag, Proxy-IP-Trust, 401/403, Static)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/me.py

@@ -1,6 +1,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 
-from app.auth import require_user
+from app.auth import require_user, is_admin_user
+from app.config import settings
 from app.dependencies import get_store
 from app.schemas import UserPrefs, MemoryCreate, MemoryOut
 from app.store import User
@@ -10,7 +11,14 @@ router = APIRouter()
 
 @router.get("/me")
 async def get_me(user: User = Depends(require_user)):
-    return {"user_id": user.id, "display_name": user.display_name, "prefs": user.prefs}
+    return {
+        "user_id": user.id,
+        "display_name": user.display_name,
+        "external_id": user.external_id,
+        "is_admin": user.is_admin or is_admin_user(user),
+        "prefs": user.prefs,
+        "sso_logout_url": settings.sso_logout_url,
+    }
 
 
 @router.put("/me/prefs")