v2: Session-Login & Rollen, Premium-Admin, Visual-Block-Builder, KI-/MCP-API

- Auth-Umbau: Session-Login (signiertes HMAC-Cookie, scrypt-Hashing) statt Basic-Auth;
  users-/audit-Tabellen, Initial-Owner aus ENV, Rate-Limit, konfigurierbarer ADMIN_PATH
  (Middleware-Rewrite), Rollen-Gate (owner/redaktion/versand), Nutzerverwaltung, Audit-Log,
  Login/Logout/Konto-Seiten.
- Premium-Pass: Command-Palette (Cmd-K), Toasts, Account-Menue, aufgewertetes Dashboard
  (KPI-Trend+Sparkline, Aktivitaets-Feed, Schnellaktionen), schoene Empty-States.
- Block-Builder: pages.blocks, Vollbild-Editor (Liste/Live-Vorschau/Settings, Desktop/Mobil),
  10 Block-Typen, Storefront-BlockRenderer auf /seite/[slug], Save-Endpoint.
- KI-Editierbarkeit: token-gesicherte /api/admin/* (CRUD), Manifest /api/admin + /ai-admin.txt,
  MCP-Server unter mcp/ (14 Tools).
- Docs: README + .env.example + mcp/README aktualisiert.

src/pages/admin/bestellungen/[id].astro

@@ -1,21 +1,23 @@
 ---
 import Admin from '../../../layouts/Admin.astro';
-import { getOrderById, updateOrderStatus, formatPrice } from '../../../lib/store.js';
+import { adminBase, currentUser } from '../../../lib/auth.js';
+const base = adminBase();
+import { getOrderById, updateOrderStatus, formatPrice, recordAudit } from '../../../lib/store.js';
 
 const { id } = Astro.params;
 let flash = '';
 if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();
   const status = form.get('status');
-  if (status) { updateOrderStatus(id, String(status)); flash = 'Status aktualisiert.'; }
+  if (status) { updateOrderStatus(id, String(status)); recordAudit({ user: currentUser(Astro.request)?.email, action: 'update', entity: 'order', entity_id: String(id) }); flash = 'Status aktualisiert.'; }
 }
 const order = getOrderById(id);
-if (!order) return Astro.redirect('/admin/bestellungen');
+if (!order) return Astro.redirect(base + '/bestellungen');
 const statusMap = { fulfilled: ['green', 'Erfüllt'], pending: ['amber', 'Offen'], cancelled: ['gray', 'Storniert'], refunded: ['red', 'Erstattet'] };
 const fmtDate = (s) => new Date(s).toLocaleString('de-DE', { day: '2-digit', month: 'long', year: 'numeric', hour: '2-digit', minute: '2-digit' });
 const statuses = [['pending', 'Offen'], ['fulfilled', 'Erfüllt'], ['cancelled', 'Storniert'], ['refunded', 'Erstattet']];
 ---
-<Admin title={`Bestellung ${order.number}`} active="bestellungen" crumbs={[{ label: 'Bestellungen', href: '/admin/bestellungen' }, { label: order.number }]}>
+<Admin title={`Bestellung ${order.number}`} active="bestellungen" crumbs={[{ label: 'Bestellungen', href: base + '/bestellungen' }, { label: order.number }]}>
   <div class="s-stack">
     {flash && <div class="s-flash">✓ {flash}</div>}
     <div class="s-two-col">