feat: Cloud-Fundament - Auth, Persistenz und Mandanten-Trennung

- SQLite-Store (app/store.py) hinter Store-Interface: Nutzer + Sessions persistent
- Bearer-Token-Auth (app/auth.py); Nutzerverwaltung via Admin-Key (POST /api/admin/users)
- GET /api/me, PUT /api/me/prefs (dauerhafte Nutzer-Praeferenzen)
- chat/speak/transcribe/sessions auth-geschuetzt; Mandanten-Trennung (fremde Session -> 403)
- Route-Aufloesung: Defaults < Profil < ENV < Nutzer-Prefs < Session < Request
- SessionManager (in-memory) durch Store ersetzt
- AUTH_ENABLED-Schalter (prod an, dev/Tests aus); DB_PATH/ADMIN_API_KEY
- Doku aktualisiert (README, BEDIENUNGSANLEITUNG, Architektur, deploy-env); data/ gitignored
- Tests: 29 gruen (Auth, Mandanten, Persistenz, Routing)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/sessions.py

@@ -1,10 +1,21 @@
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends, HTTPException
+
 from app.schemas import SessionRouteRequest
-from app.dependencies import session_manager
+from app.auth import require_user
+from app.dependencies import get_store
+from app.store import User, SessionOwnershipError
 
 router = APIRouter()
 
+
 @router.post("/sessions/{session_id}/route")
-async def set_session_route(session_id: str, payload: SessionRouteRequest):
-    session = session_manager.update(session_id, payload.model_dump())
-    return {"session_id": session_id, "route": session}
+async def set_session_route(
+    session_id: str,
+    payload: SessionRouteRequest,
+    user: User = Depends(require_user),
+):
+    try:
+        session = get_store().update_session(session_id, user.id, payload.model_dump())
+    except SessionOwnershipError as exc:
+        raise HTTPException(status_code=403, detail=str(exc))
+    return {"session_id": session_id, "route": session.data}