feat(2-Schritt2): Login-Link + persistentes is_admin-Flag pro Nutzer

- Nutzerverwaltung zeigt beim Anlegen/„Link erneuern" jetzt den vollen
  Ein-Klick-Link (location.origin/?k=<token>) statt nur des Tokens.
- Neuer Admin-Schalter pro Nutzer (DB-Spalte users.is_admin + Migration).
  is_admin_user() honoriert das Flag ODER ADMIN_USERS (SSO). Dadurch zeigt
  /me den Admin-Button anhand des Flags — Grundlage für den nginx-Cutover.
- admin.py: PUT /admin/users/{id}/admin; list_users liefert is_admin.

Migration live verifiziert (Spalte vorhanden, bestehende Admins via
ADMIN_USERS weiterhin korrekt). app.js v=45. 219 passed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/store.py

@@ -69,6 +69,8 @@ class Store(ABC):
     @abstractmethod
     def set_user_prefs(self, user_id: str, prefs: dict) -> User: ...
 
+    def set_user_admin(self, user_id: str, is_admin: bool) -> User | None: ...
+
     @abstractmethod
     def ensure_anonymous_user(self) -> User: ...
 
@@ -185,7 +187,8 @@ class SQLiteStore(Store):
                     token_hash TEXT NOT NULL UNIQUE,
                     prefs_json TEXT NOT NULL DEFAULT '{}',
                     created_at TEXT NOT NULL,
-                    external_id TEXT
+                    external_id TEXT,
+                    is_admin INTEGER NOT NULL DEFAULT 0
                 );
                 CREATE TABLE IF NOT EXISTS sessions (
                     id TEXT PRIMARY KEY,
@@ -236,6 +239,8 @@ class SQLiteStore(Store):
             cols = {row["name"] for row in conn.execute("PRAGMA table_info(users)")}
             if "external_id" not in cols:
                 conn.execute("ALTER TABLE users ADD COLUMN external_id TEXT")
+            if "is_admin" not in cols:
+                conn.execute("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0")
             # NULLs gelten in SQLite als verschieden -> Alt-Nutzer ohne external_id ok.
             conn.execute(
                 "CREATE UNIQUE INDEX IF NOT EXISTS idx_users_external"
@@ -251,6 +256,7 @@ class SQLiteStore(Store):
             prefs=json.loads(row["prefs_json"] or "{}"),
             created_at=row["created_at"],
             external_id=row["external_id"] if "external_id" in keys else None,
+            is_admin=bool(row["is_admin"]) if "is_admin" in keys else False,
         )
 
     def create_user(self, display_name: str) -> tuple[User, str]:
@@ -505,6 +511,15 @@ class SQLiteStore(Store):
             row = conn.execute("SELECT * FROM users WHERE id = ?", (user_id,)).fetchone()
         return self._row_to_user(row) if row else None
 
+    def set_user_admin(self, user_id: str, is_admin: bool) -> User | None:
+        with self._connect() as conn:
+            conn.execute(
+                "UPDATE users SET is_admin = ? WHERE id = ?",
+                (1 if is_admin else 0, user_id),
+            )
+            row = conn.execute("SELECT * FROM users WHERE id = ?", (user_id,)).fetchone()
+        return self._row_to_user(row) if row else None
+
     # ----- Notfall-Protokoll ------------------------------------------------
     def log_emergency(self, user_id: str, category: str, snippet: str) -> None:
         with self._connect() as conn: