feat: Bibliothek + Admin

- Bibliothek: grid, before/after slider, rename, download, folder assign, delete, multi-select
- Admin: stats+costs, OpenRouter key (masked/encrypted), budget, defaults, Picdrop config+test,
  models (list/add from OpenRouter/set default/delete), users (add/set password)
- api: items/:id PATCH+DELETE, folders CRUD, admin/{settings,stats,models,test-picdrop,users}
- lib/picdrop.ts (SFTP/FTPS test+upload, temp->rename)

src/pages/api/admin/settings.ts

@@ -0,0 +1,38 @@
+import type { APIRoute } from 'astro';
+import { one, query } from '../../../lib/db';
+import { encrypt, maskSecret, decrypt } from '../../../lib/crypto';
+
+export const prerender = false;
+const json = (b: unknown, s = 200) =>
+  new Response(JSON.stringify(b), { status: s, headers: { 'Content-Type': 'application/json' } });
+
+export const GET: APIRoute = async () => {
+  const s = await one<any>('SELECT * FROM settings WHERE id=1');
+  if (!s) return json({ settings: null });
+  let orMask = '';
+  if (s.openrouter_key_enc) { try { orMask = maskSecret(decrypt(s.openrouter_key_enc)); } catch { orMask = 'gesetzt'; } }
+  return json({ settings: {
+    openrouter_key_masked: orMask, openrouter_key_set: !!s.openrouter_key_enc,
+    picdrop_host: s.picdrop_host, picdrop_protocol: s.picdrop_protocol, picdrop_port: s.picdrop_port,
+    picdrop_user: s.picdrop_user, picdrop_base_path: s.picdrop_base_path,
+    picdrop_password_set: !!s.picdrop_password_enc,
+    default_dpi: s.default_dpi, default_crop_mode: s.default_crop_mode, concurrency: s.concurrency,
+    cricut_sheet_cm: s.cricut_sheet_cm, monthly_budget: s.monthly_budget, n8n_webhook_url: s.n8n_webhook_url,
+  } });
+};
+
+export const PATCH: APIRoute = async ({ request }) => {
+  const b = await request.json();
+  const sets: string[] = []; const args: any[] = [];
+  const set = (col: string, val: any) => { args.push(val); sets.push(`${col}=$${args.length}`); };
+
+  if (b.openrouter_key) set('openrouter_key_enc', encrypt(String(b.openrouter_key)));
+  if (b.picdrop_password) set('picdrop_password_enc', encrypt(String(b.picdrop_password)));
+  for (const col of ['picdrop_host', 'picdrop_protocol', 'picdrop_port', 'picdrop_user', 'picdrop_base_path',
+    'default_dpi', 'default_crop_mode', 'concurrency', 'cricut_sheet_cm', 'monthly_budget', 'n8n_webhook_url']) {
+    if (col in b) set(col, b[col] === '' ? null : b[col]);
+  }
+  if (!sets.length) return json({ ok: true });
+  await query(`UPDATE settings SET ${sets.join(',')} WHERE id=1`, args);
+  return json({ ok: true });
+};