fix(auth): require_admin akzeptiert jetzt auch SSO-Admin-Nutzer

Vorher pruefte require_admin nur den X-Admin-Key-Header — SSO-Admins
(aus ADMIN_USERS) bekamen 401. Das brach alle Admin-Panel-Tabs ausser
der Nutzerliste im Browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/auth.py

@@ -122,15 +122,21 @@ def require_user(request: Request) -> User:
     return user
 
 
-def require_admin(x_admin_key: str | None = Header(default=None)) -> None:
-    """Schuetzt die Nutzerverwaltung ueber ADMIN_API_KEY (aus der Umgebung)."""
+def require_admin(
+    request: Request, x_admin_key: str | None = Header(default=None)
+) -> None:
+    """Schuetzt Admin-Endpunkte: ADMIN_API_KEY-Header ODER SSO-Admin-Nutzer."""
     expected = settings.admin_api_key.strip()
+    if expected and x_admin_key and x_admin_key.strip() == expected:
+        return
+    client_host = request.client.host if request.client else ""
+    token = _bearer_token(request.headers.get("authorization"))
+    user = authenticate(request.headers, client_host, token)
+    if is_admin_user(user):
+        return
     if not expected:
-        raise HTTPException(
-            status_code=503, detail="Admin API not configured (ADMIN_API_KEY unset)"
-        )
-    if not x_admin_key or x_admin_key.strip() != expected:
-        raise HTTPException(status_code=401, detail="Invalid admin key")
+        raise HTTPException(status_code=503, detail="Admin API not configured (ADMIN_API_KEY unset)")
+    raise HTTPException(status_code=401, detail="Admin privileges required")
 
 
 def require_admin_or_user(