feat: User-Zuordnung für Sessions und Agents

- UserId-Feld zu SessionRecord und AgentRecord hinzugefügt
- DB-Migration: user_id Spalte + bestehende Daten dem Admin zuweisen
- Alle Endpoints filtern/prüfen nach UserId des eingeloggten Users
- HttpContextExtensions.GetUserId() Helper für konsistenten Zugriff
- Betrifft: Agent, Session, Chat, History, Workspace, Skill Endpoints
- Sessions/Agents anderer User sind nicht sichtbar/zugreifbar

Endpoints/AgentEndpoint.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using System.Threading.Tasks;
+using Gott.Extensions;
 using Gott.Models;
 using Gott.Services;
 using Microsoft.AspNetCore.Builder;
@@ -21,7 +22,8 @@ public static class AgentEndpoint
 
     private static async Task HandleList(HttpContext ctx, DatabaseService db)
     {
-        var agents = await db.GetAgents();
+        var userId = ctx.GetUserId();
+        var agents = await db.GetAgents(userId);
         await ctx.Response.WriteAsJsonAsync(agents);
     }
 
@@ -31,13 +33,14 @@ public static class AgentEndpoint
         if (string.IsNullOrEmpty(agentId)) { ctx.Response.StatusCode = 400; return; }
 
         var agent = await db.GetAgent(agentId);
-        if (agent == null) { ctx.Response.StatusCode = 404; return; }
+        if (agent == null || agent.UserId != ctx.GetUserId()) { ctx.Response.StatusCode = 404; return; }
 
         await ctx.Response.WriteAsJsonAsync(agent);
     }
 
     private static async Task HandleCreate(HttpContext ctx, DatabaseService db, ImageService imageService, MemoryService memoryService)
     {
+        var userId = ctx.GetUserId();
         var body = await JsonSerializer.DeserializeAsync<JsonElement>(ctx.Request.Body);
 
         var avatarRaw = body.TryGetProperty("avatar", out var av) ? av.GetString() : null;
@@ -48,6 +51,7 @@ public static class AgentEndpoint
 
         var agent = new AgentRecord
         {
+            UserId = userId,
             Name = body.TryGetProperty("name", out var n) ? n.GetString() ?? "Neuer Agent" : "Neuer Agent",
             Avatar = imageService.ResizeDataUrl(avatarRaw),
             Description = body.TryGetProperty("description", out var d) ? d.GetString() : null,
@@ -68,11 +72,12 @@ public static class AgentEndpoint
 
     private static async Task HandleUpdate(HttpContext ctx, DatabaseService db, ImageService imageService, MemoryService memoryService)
     {
+        var userId = ctx.GetUserId();
         var agentId = ctx.Request.RouteValues["agentId"]?.ToString();
         if (string.IsNullOrEmpty(agentId)) { ctx.Response.StatusCode = 400; return; }
 
         var agent = await db.GetAgent(agentId);
-        if (agent == null) { ctx.Response.StatusCode = 404; return; }
+        if (agent == null || agent.UserId != userId) { ctx.Response.StatusCode = 404; return; }
 
         var body = await JsonSerializer.DeserializeAsync<JsonElement>(ctx.Request.Body);
 
@@ -97,10 +102,11 @@ public static class AgentEndpoint
 
     private static async Task HandleDelete(HttpContext ctx, DatabaseService db)
     {
+        var userId = ctx.GetUserId();
         var agentId = ctx.Request.RouteValues["agentId"]?.ToString();
         if (string.IsNullOrEmpty(agentId)) { ctx.Response.StatusCode = 400; return; }
 
-        await db.DeleteAgent(agentId);
+        await db.DeleteAgent(agentId, userId);
         ctx.Response.StatusCode = 204;
     }
 }