feat: Cloud-Fundament - Auth, Persistenz und Mandanten-Trennung

- SQLite-Store (app/store.py) hinter Store-Interface: Nutzer + Sessions persistent
- Bearer-Token-Auth (app/auth.py); Nutzerverwaltung via Admin-Key (POST /api/admin/users)
- GET /api/me, PUT /api/me/prefs (dauerhafte Nutzer-Praeferenzen)
- chat/speak/transcribe/sessions auth-geschuetzt; Mandanten-Trennung (fremde Session -> 403)
- Route-Aufloesung: Defaults < Profil < ENV < Nutzer-Prefs < Session < Request
- SessionManager (in-memory) durch Store ersetzt
- AUTH_ENABLED-Schalter (prod an, dev/Tests aus); DB_PATH/ADMIN_API_KEY
- Doku aktualisiert (README, BEDIENUNGSANLEITUNG, Architektur, deploy-env); data/ gitignored
- Tests: 29 gruen (Auth, Mandanten, Persistenz, Routing)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/speak.py

@@ -1,10 +1,12 @@
 from io import BytesIO
 
-from fastapi import APIRouter, HTTPException, Query
+from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi.responses import StreamingResponse
 
 from app.config import settings
 from app.errors import RoutingError
+from app.auth import require_user
+from app.store import User, SessionOwnershipError
 from app.dependencies import (
     resolve_route,
     build_orchestrator,
@@ -22,18 +24,21 @@ async def speak(
         default=None,
         description="Optional session id to apply a stored route",
     ),
+    user: User = Depends(require_user),
 ):
     overrides = {
         "output_endpoint": payload.output_endpoint,
         "language": payload.language,
         "tts_provider": payload.tts_provider,
     }
-    route = resolve_route(session_id, overrides)
     voice = payload.voice or settings.openrouter_tts_voice
 
     try:
+        route = resolve_route(user, session_id, overrides)
         orchestrator = build_orchestrator(route)
         output = await resolve_output_endpoint(route)
+    except SessionOwnershipError as exc:
+        raise HTTPException(status_code=403, detail=str(exc))
     except RoutingError as exc:
         raise HTTPException(status_code=422, detail=str(exc))