feat: Cloud-Fundament - Auth, Persistenz und Mandanten-Trennung

- SQLite-Store (app/store.py) hinter Store-Interface: Nutzer + Sessions persistent
- Bearer-Token-Auth (app/auth.py); Nutzerverwaltung via Admin-Key (POST /api/admin/users)
- GET /api/me, PUT /api/me/prefs (dauerhafte Nutzer-Praeferenzen)
- chat/speak/transcribe/sessions auth-geschuetzt; Mandanten-Trennung (fremde Session -> 403)
- Route-Aufloesung: Defaults < Profil < ENV < Nutzer-Prefs < Session < Request
- SessionManager (in-memory) durch Store ersetzt
- AUTH_ENABLED-Schalter (prod an, dev/Tests aus); DB_PATH/ADMIN_API_KEY
- Doku aktualisiert (README, BEDIENUNGSANLEITUNG, Architektur, deploy-env); data/ gitignored
- Tests: 29 gruen (Auth, Mandanten, Persistenz, Routing)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_auth.py

@@ -0,0 +1,91 @@
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.config import settings
+
+client = TestClient(app)
+
+ADMIN = "admin-secret"
+
+
+def _enable_auth(monkeypatch):
+    monkeypatch.setattr(settings, "auth_enabled", True)
+    monkeypatch.setattr(settings, "admin_api_key", ADMIN)
+
+
+def _create_user(name: str) -> str:
+    resp = client.post(
+        "/api/admin/users", headers={"X-Admin-Key": ADMIN}, json={"display_name": name}
+    )
+    assert resp.status_code == 200
+    return resp.json()["token"]
+
+
+def test_protected_endpoint_requires_token(monkeypatch):
+    _enable_auth(monkeypatch)
+    resp = client.post("/api/speak", json={"text": "x", "tts_provider": "piper"})
+    assert resp.status_code == 401
+
+
+def test_admin_requires_key(monkeypatch):
+    _enable_auth(monkeypatch)
+    resp = client.post("/api/admin/users", json={"display_name": "Anna"})
+    assert resp.status_code == 401
+
+
+def test_create_user_and_call_me(monkeypatch):
+    _enable_auth(monkeypatch)
+    token = _create_user("Anna")
+    auth = {"Authorization": f"Bearer {token}"}
+
+    me = client.get("/api/me", headers=auth)
+    assert me.status_code == 200
+    assert me.json()["display_name"] == "Anna"
+
+    bad = client.get("/api/me", headers={"Authorization": "Bearer nope"})
+    assert bad.status_code == 401
+
+
+def test_tenant_isolation_returns_403(monkeypatch):
+    _enable_auth(monkeypatch)
+    token_a = _create_user("A")
+    token_b = _create_user("B")
+
+    client.post(
+        "/api/sessions/shared/route",
+        headers={"Authorization": f"Bearer {token_a}"},
+        json={"tts_provider": "piper"},
+    )
+    # B versucht die Session von A zu nutzen.
+    resp = client.post(
+        "/api/speak?session_id=shared",
+        headers={"Authorization": f"Bearer {token_b}"},
+        json={"text": "x"},
+    )
+    assert resp.status_code == 403
+
+
+def test_user_prefs_applied_to_route(monkeypatch):
+    _enable_auth(monkeypatch)
+    token = _create_user("Pref")
+    auth = {"Authorization": f"Bearer {token}"}
+
+    client.put(
+        "/api/me/prefs",
+        headers=auth,
+        json={"tts_provider": "piper", "output_endpoint": "loopback"},
+    )
+    resp = client.post("/api/speak", headers=auth, json={"text": "hallo"})
+    assert resp.status_code == 200
+    assert resp.headers["X-TTS-Provider"] == "piper"
+    assert resp.headers["X-Output-Endpoint"] == "loopback"
+
+
+def test_admin_unconfigured_returns_503(monkeypatch):
+    # Auth an, aber kein Admin-Key gesetzt.
+    monkeypatch.setattr(settings, "auth_enabled", True)
+    monkeypatch.setattr(settings, "admin_api_key", "")
+    resp = client.post(
+        "/api/admin/users", headers={"X-Admin-Key": "irgendwas"}, json={"display_name": "X"}
+    )
+    assert resp.status_code == 503