v2: Session-Login & Rollen, Premium-Admin, Visual-Block-Builder, KI-/MCP-API

- Auth-Umbau: Session-Login (signiertes HMAC-Cookie, scrypt-Hashing) statt Basic-Auth;
  users-/audit-Tabellen, Initial-Owner aus ENV, Rate-Limit, konfigurierbarer ADMIN_PATH
  (Middleware-Rewrite), Rollen-Gate (owner/redaktion/versand), Nutzerverwaltung, Audit-Log,
  Login/Logout/Konto-Seiten.
- Premium-Pass: Command-Palette (Cmd-K), Toasts, Account-Menue, aufgewertetes Dashboard
  (KPI-Trend+Sparkline, Aktivitaets-Feed, Schnellaktionen), schoene Empty-States.
- Block-Builder: pages.blocks, Vollbild-Editor (Liste/Live-Vorschau/Settings, Desktop/Mobil),
  10 Block-Typen, Storefront-BlockRenderer auf /seite/[slug], Save-Endpoint.
- KI-Editierbarkeit: token-gesicherte /api/admin/* (CRUD), Manifest /api/admin + /ai-admin.txt,
  MCP-Server unter mcp/ (14 Tools).
- Docs: README + .env.example + mcp/README aktualisiert.

src/pages/admin/audit/index.astro

@@ -0,0 +1,31 @@
+---
+import Admin from '../../../layouts/Admin.astro';
+import { listAudit } from '../../../lib/store.js';
+const rows = listAudit(300);
+const fmt = (s) => new Date(s).toLocaleString('de-DE', { day: '2-digit', month: 'short', hour: '2-digit', minute: '2-digit' });
+const actionLabel = { create: ['green', 'Angelegt'], update: ['blue', 'Geändert'], delete: ['red', 'Gelöscht'], login: ['gray', 'Login'], password_change: ['amber', 'Passwort'], password_reset: ['amber', 'PW-Reset'] };
+---
+<Admin title="Aktivität (Audit)" active="audit" crumbs={[{ label: 'Audit' }]}>
+  <div class="s-card">
+    <div class="s-card-head">Letzte Aktivitäten</div>
+    <div class="s-table-wrap">
+      <table class="s-table">
+        <thead><tr><th>Zeit</th><th>Nutzer</th><th>Aktion</th><th>Objekt</th></tr></thead>
+        <tbody>
+          {rows.length === 0 ? (<tr><td colspan="4" class="s-empty">Noch keine Aktivität aufgezeichnet</td></tr>) :
+            rows.map((r) => {
+              const a = actionLabel[r.action] || ['gray', r.action];
+              return (
+                <tr>
+                  <td class="s-muted">{fmt(r.created_at)}</td>
+                  <td><b>{r.user || '—'}</b></td>
+                  <td><span class={`s-badge ${a[0]}`}>{a[1]}</span></td>
+                  <td class="s-muted">{r.entity}{r.entity_id ? ' #' + r.entity_id : ''}</td>
+                </tr>
+              );
+            })}
+        </tbody>
+      </table>
+    </div>
+  </div>
+</Admin>