v2: Session-Login & Rollen, Premium-Admin, Visual-Block-Builder, KI-/MCP-API

- Auth-Umbau: Session-Login (signiertes HMAC-Cookie, scrypt-Hashing) statt Basic-Auth;
  users-/audit-Tabellen, Initial-Owner aus ENV, Rate-Limit, konfigurierbarer ADMIN_PATH
  (Middleware-Rewrite), Rollen-Gate (owner/redaktion/versand), Nutzerverwaltung, Audit-Log,
  Login/Logout/Konto-Seiten.
- Premium-Pass: Command-Palette (Cmd-K), Toasts, Account-Menue, aufgewertetes Dashboard
  (KPI-Trend+Sparkline, Aktivitaets-Feed, Schnellaktionen), schoene Empty-States.
- Block-Builder: pages.blocks, Vollbild-Editor (Liste/Live-Vorschau/Settings, Desktop/Mobil),
  10 Block-Typen, Storefront-BlockRenderer auf /seite/[slug], Save-Endpoint.
- KI-Editierbarkeit: token-gesicherte /api/admin/* (CRUD), Manifest /api/admin + /ai-admin.txt,
  MCP-Server unter mcp/ (14 Tools).
- Docs: README + .env.example + mcp/README aktualisiert.

src/pages/ai-admin.txt.js

@@ -0,0 +1,33 @@
+import { manifest } from '../lib/admin-api.js';
+export const prerender = false;
+
+export async function GET({ request }) {
+  const origin = new URL(request.url).origin;
+  const m = manifest(origin);
+  const lines = [];
+  lines.push('# hd-commerce — KI-Admin-Manifest');
+  lines.push('# Maschinenlesbare Beschreibung der Admin-API für LLMs/Agenten.');
+  lines.push('');
+  lines.push('Auth: ' + m.auth);
+  lines.push('Base-URL: ' + (m.base_url || origin));
+  lines.push('Version: ' + m.version);
+  lines.push('');
+  lines.push('## Ressourcen');
+  for (const [name, def] of Object.entries(m.resources)) {
+    lines.push(`- ${name} (${def.rw ? 'lesen+schreiben' : 'nur lesen'}): ${def.fields.join(', ')}`);
+  }
+  lines.push('');
+  lines.push('## Block-Typen (pages.blocks)');
+  for (const b of m.block_types) {
+    lines.push(`- ${b.key} (${b.label}): ${b.fields.map(f => f.name + ':' + f.type).join(', ') || '—'}`);
+  }
+  lines.push('');
+  lines.push('## Endpunkte');
+  for (const e of m.endpoints) lines.push(`${e.method} ${e.path}  — ${e.desc}`);
+  lines.push('');
+  lines.push('## Hinweise');
+  for (const n of m.notes) lines.push('- ' + n);
+  lines.push('');
+  lines.push('JSON-Manifest: GET /api/admin (Bearer-Token erforderlich)');
+  return new Response(lines.join('\n'), { status: 200, headers: { 'Content-Type': 'text/plain; charset=utf-8' } });
+}