Phase 3.6: B+C+D komplett + HealthKit Sync

D.10 401-Handling: APIError.unauthorized, NotificationCenter-Bridge,
  AuthSession.logout() bei 401 → User landet wieder im Login

D.12 PWA-Deep-Links: Settings-Section mit Forum/Hunde/Walks/Settings
  öffnet Safari per https://banyaro.app/#fragment

B.4 Auto-Pause: 2-min-Inaktivität → isAutoPaused, automatischer Resume bei
  nächstem GPS-Update. Settings-Toggle, im UI eigenes Badge "Auto-Pause"
  (grau vs. Pause orange).

C.7 Edit/Delete: RouteUpdateBody + APIClient.patch + APIClient.delete,
  EditRouteSheet (Name/Beschreibung/Public), Menu in Toolbar (nur eigene
  Touren), Alert für Delete.

C.9 Statistik-Tab: neuer Tab "Statistik" zwischen Hunde und Mehr. Filtert
  /api/routes auf meine Touren, rechnet Woche/Monat/Allzeit (Distanz, Dauer,
  Touren), Längste Tour, aktuelle Streak (Tage in Folge).

B.5 Walk-Review: Map-Header an die Spitze des FinishWalkSheet-Forms.

B.6 Geo-Fotos: CapturedPhoto (Data + GPSPoint?), PhotoLocation @Model in
  SwiftData. Kamera während Walk taggt mit tracker.points.last. Nach Upload:
  foto_url aus Response → PhotoLocation persistiert. MiniRouteMap rendert
  Annotations mit Tap-Callback, PhotoViewerSheet zeigt Foto fullscreen.

C.8 Share PNG+GPX: RouteShareImage (MKMapSnapshotter + Polyline overlay +
  SwiftUI ShareCard via ImageRenderer), GPXExporter (Tempfile mit XML),
  ShareSheet (UIActivityViewController-Wrapper), Menu in Route-Toolbar.

D.11 Icon-Varianten: AppIcon-Dark (0.45 Brightness), AppIcon-Tinted
  (Grayscale + Kontrastverstärkung), Contents.json mit appearance entries.

A.2 HealthKit: BanYaroGo.entitlements (com.apple.developer.healthkit),
  NSHealthShare/UpdateUsageDescription. WalkHealthSync.shared mit
  HKWorkoutBuilder (.walking) + HKWorkoutRouteBuilder, Timestamps gleichmäßig
  über Walk-Dauer verteilt. Settings-Toggle mit Permission-Request.

BanYaroGo/API/APIClient.swift

@@ -85,6 +85,10 @@ final class APIClient {
         guard let http = response as? HTTPURLResponse else {
             throw APIError.invalidResponse
         }
+        if http.statusCode == 401 {
+            NotificationCenter.default.post(name: .apiUnauthorized, object: nil)
+            throw APIError.unauthorized
+        }
         guard (200..<300).contains(http.statusCode) else {
             let detail = Self.parseErrorDetail(from: data)
             throw APIError.server(status: http.statusCode, message: detail)
@@ -92,6 +96,45 @@ final class APIClient {
         return try decoder.decode(T.self, from: data)
     }
 
+    /// Convenience for DELETE with no response body.
+    func delete(_ path: String) async throws {
+        let url = baseURL.appending(path: path)
+        var req = URLRequest(url: url)
+        req.httpMethod = "DELETE"
+        if let token { req.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization") }
+        let (data, response) = try await session.data(for: req)
+        guard let http = response as? HTTPURLResponse else { throw APIError.invalidResponse }
+        if http.statusCode == 401 {
+            NotificationCenter.default.post(name: .apiUnauthorized, object: nil)
+            throw APIError.unauthorized
+        }
+        guard (200..<300).contains(http.statusCode) else {
+            throw APIError.server(status: http.statusCode, message: Self.parseErrorDetail(from: data))
+        }
+    }
+
+    /// Convenience for PATCH with JSON body, decoding the response.
+    func patch<T: Decodable, B: Encodable>(_ path: String, body: B) async throws -> T {
+        let data = try encoder.encode(body)
+        let url = baseURL.appending(path: path)
+        var req = URLRequest(url: url)
+        req.httpMethod = "PATCH"
+        req.setValue("application/json", forHTTPHeaderField: "Accept")
+        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        if let token { req.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization") }
+        req.httpBody = data
+        let (respData, response) = try await session.data(for: req)
+        guard let http = response as? HTTPURLResponse else { throw APIError.invalidResponse }
+        if http.statusCode == 401 {
+            NotificationCenter.default.post(name: .apiUnauthorized, object: nil)
+            throw APIError.unauthorized
+        }
+        guard (200..<300).contains(http.statusCode) else {
+            throw APIError.server(status: http.statusCode, message: Self.parseErrorDetail(from: respData))
+        }
+        return try decoder.decode(T.self, from: respData)
+    }
+
     /// FastAPI returns errors as {"detail": "message"} or {"detail": [{...}]}.
     private static func parseErrorDetail(from data: Data) -> String? {
         if let obj = try? JSONSerialization.jsonObject(with: data) as? [String: Any] {

BanYaroGo/API/APIError.swift

@@ -2,15 +2,24 @@ import Foundation
 
 enum APIError: LocalizedError {
     case invalidResponse
+    case unauthorized
     case server(status: Int, message: String?)
 
     var errorDescription: String? {
         switch self {
         case .invalidResponse:
             return "Ungültige Server-Antwort."
+        case .unauthorized:
+            return "Bitte erneut anmelden."
         case .server(let status, let message):
             if let msg = message, !msg.isEmpty { return msg }
             return "Fehler vom Server (HTTP \(status))."
         }
     }
 }
+
+extension Notification.Name {
+    /// Posted when any API call returns HTTP 401 — AuthSession listens and
+    /// logs out so the user lands back on the LoginView.
+    static let apiUnauthorized = Notification.Name("BanYaroGo.apiUnauthorized")
+}

BanYaroGo/API/DTOs.swift

@@ -88,3 +88,23 @@ struct RouteCreateBody: Encodable {
     let dogIds: [Int]
     let isPublic: Bool
 }
+
+/// Patch body for PATCH /api/routes/{id}. Only non-nil fields are encoded.
+struct RouteUpdateBody: Encodable {
+    var name: String?
+    var beschreibung: String?
+    var isPublic: Bool?
+
+    enum CodingKeys: String, CodingKey {
+        case name
+        case beschreibung
+        case isPublic
+    }
+
+    func encode(to encoder: Encoder) throws {
+        var c = encoder.container(keyedBy: CodingKeys.self)
+        try c.encodeIfPresent(name, forKey: .name)
+        try c.encodeIfPresent(beschreibung, forKey: .beschreibung)
+        try c.encodeIfPresent(isPublic, forKey: .isPublic)
+    }
+}