feat: API-Key-Auth für Krea-Endpoints (Automation ohne User-Kontext)

- AuthMiddleware: X-Api-Key Header-Prüfung für /api/images/* Routen
- Neues Config-Feld KreaApiKey in appsettings.json
- Bei gültigem API-Key wird Request ohne Cookie-Auth durchgelassen
- Normaler User-Auth funktioniert weiterhin als Fallback
- ARCHITECTURE.md + ARCHITECTURE_QUICK.md aktualisiert

Middleware/AuthMiddleware.cs

@@ -1,16 +1,19 @@
 using System.Threading.Tasks;
 using Gott.Services;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Configuration;
 
 namespace Gott.Middleware;
 
 public class AuthMiddleware
 {
     private readonly RequestDelegate _next;
+    private readonly string _kreaApiKey;
 
-    public AuthMiddleware(RequestDelegate next)
+    public AuthMiddleware(RequestDelegate next, IConfiguration config)
     {
         _next = next;
+        _kreaApiKey = config["KreaApiKey"] ?? "";
     }
 
     public async Task InvokeAsync(HttpContext ctx, AuthService auth, DatabaseService db)
@@ -27,6 +30,17 @@ public class AuthMiddleware
             return;
         }
 
+        // Krea API-Key auth (for automation without user context)
+        if (path.StartsWith("/api/images/") && !string.IsNullOrEmpty(_kreaApiKey))
+        {
+            var apiKey = ctx.Request.Headers["X-Api-Key"].ToString();
+            if (!string.IsNullOrEmpty(apiKey) && apiKey == _kreaApiKey)
+            {
+                await _next(ctx);
+                return;
+            }
+        }
+
         var token = ctx.Request.Cookies["gott_token"];
         var userId = auth.ValidateToken(token);