- AuthMiddleware: X-Api-Key Header-Prüfung für /api/images/* Routen
- Neues Config-Feld KreaApiKey in appsettings.json
- Bei gültigem API-Key wird Request ohne Cookie-Auth durchgelassen
- Normaler User-Auth funktioniert weiterhin als Fallback
- ARCHITECTURE.md + ARCHITECTURE_QUICK.md aktualisiert
- ARCHITECTURE.md: comprehensive project documentation (868 lines)
covering all 21 chapters (data model, services, endpoints,
chat pipeline, tool system, agents, memory, skills, telegram,
cronjobs, krea, auth, workspace, deployment, config)
- ARCHITECTURE_QUICK.md: compact quick-reference (223 lines)
for fast lookups during development
- chat.css: add .msg.user.markdown pre selector so code blocks
in user messages get correct background color (was only on code)