v2: Session-Login & Rollen, Premium-Admin, Visual-Block-Builder, KI-/MCP-API

- Auth-Umbau: Session-Login (signiertes HMAC-Cookie, scrypt-Hashing) statt Basic-Auth;
  users-/audit-Tabellen, Initial-Owner aus ENV, Rate-Limit, konfigurierbarer ADMIN_PATH
  (Middleware-Rewrite), Rollen-Gate (owner/redaktion/versand), Nutzerverwaltung, Audit-Log,
  Login/Logout/Konto-Seiten.
- Premium-Pass: Command-Palette (Cmd-K), Toasts, Account-Menue, aufgewertetes Dashboard
  (KPI-Trend+Sparkline, Aktivitaets-Feed, Schnellaktionen), schoene Empty-States.
- Block-Builder: pages.blocks, Vollbild-Editor (Liste/Live-Vorschau/Settings, Desktop/Mobil),
  10 Block-Typen, Storefront-BlockRenderer auf /seite/[slug], Save-Endpoint.
- KI-Editierbarkeit: token-gesicherte /api/admin/* (CRUD), Manifest /api/admin + /ai-admin.txt,
  MCP-Server unter mcp/ (14 Tools).
- Docs: README + .env.example + mcp/README aktualisiert.

src/middleware.js

@@ -1,8 +1,8 @@
 import { recordEvent, getSetting } from './lib/store.js';
 import { createHash } from 'node:crypto';
-
-const USER = process.env.ADMIN_USER || 'admin';
-const PASS = process.env.ADMIN_PASS || 'admin';
+import {
+  currentUser, adminBase, adminPathSegment, isCustomAdminPath, canAccess, landingFor,
+} from './lib/auth.js';
 
 const SKIP = ['/api/', '/uploads/', '/_astro', '/favicon', '/_image', '/robots.txt'];
 
@@ -13,26 +13,70 @@ function sessionHash(request) {
   return createHash('sha256').update(ip + ua + day).digest('hex').slice(0, 16);
 }
 
-export function onRequest({ request }, next) {
+function sectionOf(adminInner) {
+  const seg = adminInner.replace(/^\//, '').split('/')[0] || 'dashboard';
+  const map = {
+    '': 'dashboard', 'bestellungen': 'bestellungen', 'produkte': 'produkte', 'kunden': 'kunden',
+    'analytics': 'analytics', 'marketing': 'marketing', 'inhalte': 'inhalte', 'einstellungen': 'einstellungen',
+    'nutzer': 'nutzer', 'audit': 'audit', 'konto': 'dashboard', 'login': 'login', 'logout': 'logout',
+  };
+  return map[seg] || 'dashboard';
+}
+
+export async function onRequest(context, next) {
+  const { request, locals } = context;
   const url = new URL(request.url);
   const path = url.pathname;
+  const base = adminBase();           // "/login" oder "/admin"
+  const custom = isCustomAdminPath();
 
-  // --- Admin Basic-Auth ---
-  if (path.startsWith('/admin')) {
-    const hdr = request.headers.get('authorization') || '';
-    if (hdr.startsWith('Basic ')) {
-      let dec = ''; try { dec = atob(hdr.slice(6)); } catch {}
-      const i = dec.indexOf(':');
-      if (i > -1 && dec.slice(0, i) === USER && dec.slice(i + 1) === PASS) return next();
-    }
-    const shop = getSetting('shop_name', 'hd-commerce');
-    return new Response('Authentifizierung erforderlich', {
-      status: 401,
-      headers: { 'WWW-Authenticate': `Basic realm="${shop} Admin", charset="UTF-8"` },
-    });
+  // Interner Rewrite-Durchlauf (auf physische /admin-Routen) -> einfach durchreichen.
+  if (locals && locals.__hdcAdminRewrite) {
+    return next();
   }
 
-  // --- First-Party Pageview-Tracking (nur Storefront-GET-Seiten) ---
+  // Custom-Admin-Pfad: direkter Zugriff auf physische /admin-Routen blocken (404).
+  if (custom && (path === '/admin' || path.startsWith('/admin/'))) {
+    return new Response('Not Found', { status: 404 });
+  }
+
+  // Admin-Bereich unter konfiguriertem Pfad
+  const isAdmin = path === base || path.startsWith(base + '/');
+  if (isAdmin) {
+    let inner = path.slice(base.length); // "" oder "/bestellungen/3"
+    if (inner === '') inner = '/';
+    const innerSeg = inner.replace(/^\//, '').split('/')[0];
+    const isLoginRoute = innerSeg === 'login';
+    const isLogoutRoute = innerSeg === 'logout';
+
+    const user = currentUser(request);
+
+    if (!user && !isLoginRoute) {
+      // Nicht eingeloggt -> Login-Seite rendern (HTTP 200).
+      if (locals) locals.__hdcAdminRewrite = true;
+      return context.rewrite('/admin/login?next=' + encodeURIComponent(path));
+    }
+
+    if (user && !isLoginRoute && !isLogoutRoute) {
+      const section = sectionOf(inner);
+      if (section !== 'dashboard' && section !== 'login' && section !== 'logout' && !canAccess(user.role, section)) {
+        return Response.redirect(new URL(landingFor(user.role), url), 302);
+      }
+      if (section === 'dashboard' && !canAccess(user.role, 'dashboard')) {
+        return Response.redirect(new URL(landingFor(user.role), url), 302);
+      }
+    }
+
+    // Auf physische /admin-Routen umschreiben.
+    if (custom) {
+      if (locals) locals.__hdcAdminRewrite = true;
+      const target = '/admin' + (inner === '/' ? '' : inner) + url.search;
+      return context.rewrite(target);
+    }
+    return next();
+  }
+
+  // First-Party Pageview-Tracking (nur Storefront-GET-Seiten)
   if (request.method === 'GET' && !SKIP.some(s => path.startsWith(s))) {
     try {
       recordEvent({