Session 2026-04-20: Medien-Konvertierung, Umami Analytics, Username/Privacy

- HEIC→JPEG, MOV/AVI→MP4 Konvertierung bei allen Upload-Endpoints (media_utils.py)
- ffmpeg im Docker-Image, Video-Thumbnails (extract_video_thumb, poster-Attribut)
- Google Analytics entfernt, Umami self-hosted eingebunden (index.html, datenschutz.js)
- Admin-Panel Analytics-Tab: Stat-Cards, Sparkline 7 Tage, Top-Seiten (Umami-API-Proxy)
- Admin-Panel Tab-Icons korrigiert (aus vorhandenem Phosphor-Sprite)
- users.real_name Spalte: Username öffentlich, echter Name privat und optional
- Registrierung: Label "Benutzername", Leerzeichen verboten, Profanity-Blockliste
- Datenschutzerklärung: GA-Abschnitt durch Umami-Text ersetzt

backend/routes/admin.py

@@ -17,6 +17,26 @@ router = APIRouter()
 _TZ         = ZoneInfo("Europe/Berlin")
 _start_time = time.time()
 
+# Umami token cache
+_umami_token: dict = {"token": None, "expires": 0.0}
+
+
+async def _umami_auth() -> str:
+    global _umami_token
+    if _umami_token["token"] and time.time() < _umami_token["expires"]:
+        return _umami_token["token"]
+    import httpx
+    url  = os.getenv("UMAMI_URL", "").rstrip("/")
+    resp = await httpx.AsyncClient().post(
+        f"{url}/api/auth/login",
+        json={"username": os.getenv("UMAMI_USERNAME"), "password": os.getenv("UMAMI_PASSWORD")},
+        timeout=10,
+    )
+    resp.raise_for_status()
+    tok = resp.json()["token"]
+    _umami_token = {"token": tok, "expires": time.time() + 23 * 3600}
+    return tok
+
 # Audit-Tabelle anlegen (einmalig beim Import)
 with db() as _conn:
     _conn.executescript("""
@@ -481,3 +501,52 @@ async def audit_log(limit: int = 50, user=Depends(require_admin)):
             (min(limit, 200),),
         ).fetchall()
     return [dict(r) for r in rows]
+
+
+# ------------------------------------------------------------------
+# GET /api/admin/analytics — Umami-Proxy
+# ------------------------------------------------------------------
+@router.get("/analytics")
+async def get_analytics(user=Depends(require_mod)):
+    import httpx
+    from datetime import timedelta
+    url     = os.getenv("UMAMI_URL", "").rstrip("/")
+    site_id = os.getenv("UMAMI_SITE_ID", "")
+    if not url or not site_id:
+        raise HTTPException(503, "Umami nicht konfiguriert.")
+    token   = await _umami_auth()
+    headers = {"Authorization": f"Bearer {token}"}
+
+    now         = datetime.now(_TZ)
+    today_start = now.replace(hour=0, minute=0, second=0, microsecond=0)
+    week_start  = today_start - timedelta(days=6)
+    now_ms      = int(now.timestamp() * 1000)
+    today_ms    = int(today_start.timestamp() * 1000)
+    week_ms     = int(week_start.timestamp() * 1000)
+
+    async with httpx.AsyncClient(timeout=10) as c:
+        r_today = await c.get(f"{url}/api/websites/{site_id}/stats",
+                              params={"startAt": today_ms, "endAt": now_ms}, headers=headers)
+        r_week  = await c.get(f"{url}/api/websites/{site_id}/stats",
+                              params={"startAt": week_ms,  "endAt": now_ms}, headers=headers)
+        r_pv    = await c.get(f"{url}/api/websites/{site_id}/pageviews",
+                              params={"startAt": week_ms, "endAt": now_ms,
+                                      "unit": "day", "timezone": "Europe/Berlin"}, headers=headers)
+        r_pages = await c.get(f"{url}/api/websites/{site_id}/metrics",
+                              params={"startAt": week_ms, "endAt": now_ms,
+                                      "type": "url", "limit": 8}, headers=headers)
+
+    def _to_list(r):
+        j = r.json()
+        if isinstance(j, list):
+            return j
+        if isinstance(j, dict):
+            return j.get("data", j.get("metrics", []))
+        return []
+
+    return {
+        "today":     r_today.json(),
+        "week":      r_week.json(),
+        "pageviews": r_pv.json(),
+        "top_pages": _to_list(r_pages),
+    }