feat: User-Zuordnung für Sessions und Agents

- UserId-Feld zu SessionRecord und AgentRecord hinzugefügt
- DB-Migration: user_id Spalte + bestehende Daten dem Admin zuweisen
- Alle Endpoints filtern/prüfen nach UserId des eingeloggten Users
- HttpContextExtensions.GetUserId() Helper für konsistenten Zugriff
- Betrifft: Agent, Session, Chat, History, Workspace, Skill Endpoints
- Sessions/Agents anderer User sind nicht sichtbar/zugreifbar

Endpoints/SessionEndpoint.cs

@@ -4,6 +4,7 @@ using System.Diagnostics;
 using System.Linq;
 using System.Text.Json;
 using System.Threading.Tasks;
+using Gott.Extensions;
 using Gott.Services;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
@@ -29,12 +30,14 @@ public static class SessionEndpoint
 
     private static async Task HandleList(HttpContext ctx, DatabaseService db)
     {
-        var sessions = await db.GetSessionsWithStats();
+        var userId = ctx.GetUserId();
+        var sessions = await db.GetSessionsWithStats(userId);
         await ctx.Response.WriteAsJsonAsync(sessions);
     }
 
     private static async Task HandleGet(HttpContext ctx, DatabaseService db)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId))
         {
@@ -42,7 +45,7 @@ public static class SessionEndpoint
             return;
         }
         var session = await db.GetSession(sessionId);
-        if (session == null)
+        if (session == null || session.UserId != userId)
         {
             ctx.Response.StatusCode = 404;
             return;
@@ -52,6 +55,7 @@ public static class SessionEndpoint
 
     private static async Task HandleCreate(HttpContext ctx, DatabaseService db, ImageService imageService)
     {
+        var userId = ctx.GetUserId();
         var body = await JsonSerializer.DeserializeAsync<JsonElement>(ctx.Request.Body);
 
         var name = body.TryGetProperty("name", out var n) ? n.GetString() : "Neue Session";
@@ -63,12 +67,13 @@ public static class SessionEndpoint
         var context = body.TryGetProperty("context", out var ctxEl) ? ctxEl.GetString() : null;
         var customCommands = body.TryGetProperty("customCommands", out var cc) && cc.ValueKind != JsonValueKind.Null ? cc.GetRawText() : null;
 
-        var session = await db.CreateSession(name, description, image, agentId, workspace, context, customCommands);
+        var session = await db.CreateSession(userId, name, description, image, agentId, workspace, context, customCommands);
         await ctx.Response.WriteAsJsonAsync(session);
     }
 
     private static async Task HandleUpdate(HttpContext ctx, DatabaseService db, ImageService imageService)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId))
         {
@@ -76,6 +81,13 @@ public static class SessionEndpoint
             return;
         }
 
+        var existing = await db.GetSession(sessionId);
+        if (existing == null || existing.UserId != userId)
+        {
+            ctx.Response.StatusCode = 404;
+            return;
+        }
+
         var body = await JsonSerializer.DeserializeAsync<JsonElement>(ctx.Request.Body);
         await db.UpdateSession(sessionId, body, imageService);
 
@@ -85,15 +97,17 @@ public static class SessionEndpoint
 
     private static async Task HandleDelete(HttpContext ctx, DatabaseService db)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId)) { ctx.Response.StatusCode = 400; return; }
 
-        await db.DeleteSession(sessionId);
+        await db.DeleteSession(sessionId, userId);
         ctx.Response.StatusCode = 204;
     }
 
     private static async Task HandleSystemPrompt(HttpContext ctx, DatabaseService db, MemoryService memoryService, SkillService skillService)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId))
         {
@@ -102,7 +116,7 @@ public static class SessionEndpoint
         }
 
         var session = await db.GetSession(sessionId);
-        if (session == null)
+        if (session == null || session.UserId != userId)
         {
             ctx.Response.StatusCode = 404;
             return;
@@ -135,11 +149,12 @@ public static class SessionEndpoint
 
     private static async Task HandleSystemPromptBlocks(HttpContext ctx, DatabaseService db, MemoryService memoryService, SkillService skillService)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId)) { ctx.Response.StatusCode = 400; return; }
 
         var session = await db.GetSession(sessionId);
-        if (session == null) { ctx.Response.StatusCode = 404; return; }
+        if (session == null || session.UserId != userId) { ctx.Response.StatusCode = 404; return; }
 
         if (string.IsNullOrEmpty(session.AgentId))
         {
@@ -165,8 +180,9 @@ public static class SessionEndpoint
         await ctx.Response.WriteAsJsonAsync(blocks.Select(b => new { b.Icon, b.Label, b.Content }));
     }
 
-    private static async Task HandleStreaming(HttpContext ctx, StreamingTracker streamingTracker)
+    private static async Task HandleStreaming(HttpContext ctx, DatabaseService db, StreamingTracker streamingTracker)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId))
         {
@@ -174,6 +190,13 @@ public static class SessionEndpoint
             return;
         }
 
+        var session = await db.GetSession(sessionId);
+        if (session == null || session.UserId != userId)
+        {
+            ctx.Response.StatusCode = 404;
+            return;
+        }
+
         var isStreaming = streamingTracker.IsStreaming(sessionId);
         var chainId = streamingTracker.GetChainId(sessionId);
         await ctx.Response.WriteAsJsonAsync(new { streaming = isStreaming, chainId });
@@ -181,6 +204,7 @@ public static class SessionEndpoint
 
     private static async Task HandleExec(HttpContext ctx, DatabaseService db)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId))
         {
@@ -189,7 +213,7 @@ public static class SessionEndpoint
         }
 
         var session = await db.GetSession(sessionId);
-        if (session == null)
+        if (session == null || session.UserId != userId)
         {
             ctx.Response.StatusCode = 404;
             return;
@@ -304,6 +328,7 @@ public static class SessionEndpoint
 
     private static async Task HandleGitStatus(HttpContext ctx, DatabaseService db)
     {
+        var userId = ctx.GetUserId();
         var sessionId = ctx.Request.RouteValues["sessionId"]?.ToString();
         if (string.IsNullOrEmpty(sessionId))
         {
@@ -312,7 +337,7 @@ public static class SessionEndpoint
         }
 
         var session = await db.GetSession(sessionId);
-        if (session == null)
+        if (session == null || session.UserId != userId)
         {
             ctx.Response.StatusCode = 404;
             return;