Feature: System settings in DB - configurable backend URLs and API key

backend/api/handlers.go

@@ -59,6 +59,10 @@ func (h *Handler) SetupRoutes(mux *http.ServeMux, hub *ws.Hub) {
 	mux.HandleFunc("POST /api/v1/apikeys", h.createAPIKey)
 	mux.HandleFunc("DELETE /api/v1/apikeys/{id}", h.deleteAPIKey)
 
+	// System Settings
+	mux.HandleFunc("GET /api/v1/settings", h.getSettings)
+	mux.HandleFunc("PUT /api/v1/settings", h.updateSettings)
+
 	// Audit-Log
 	mux.HandleFunc("GET /api/v1/audit", h.getAuditLogs)
 

backend/api/settings.go

@@ -0,0 +1,58 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// GET /api/v1/settings
+func (h *Handler) getSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := h.db.GetSettings()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "Settings laden fehlgeschlagen")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"data": settings})
+}
+
+// PUT /api/v1/settings (JWT only - checked via context)
+func (h *Handler) updateSettings(w http.ResponseWriter, r *http.Request) {
+	// JWT-only: check that user context exists
+	claims := r.Context().Value(UserContextKey)
+	if claims == nil {
+		writeError(w, http.StatusForbidden, "Nur mit JWT-Authentifizierung erlaubt")
+		return
+	}
+
+	var body map[string]string
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungueltige Anfrage")
+		return
+	}
+
+	allowedKeys := map[string]bool{
+		"backend_url_internal": true,
+		"backend_url_external": true,
+		"api_key":              true,
+	}
+
+	var changed []string
+	for k, v := range body {
+		if !allowedKeys[k] {
+			continue
+		}
+		if err := h.db.SetSetting(k, v); err != nil {
+			writeError(w, http.StatusInternalServerError, fmt.Sprintf("Setting '%s' speichern fehlgeschlagen", k))
+			return
+		}
+		changed = append(changed, k)
+	}
+
+	if len(changed) > 0 {
+		h.auditLog(r, "settings.update", "settings", "", "", "Geaendert: "+strings.Join(changed, ", "))
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Settings aktualisiert"})
+}