Session 2026-04-20: Medien-Konvertierung, Umami Analytics, Username/Privacy

- HEIC→JPEG, MOV/AVI→MP4 Konvertierung bei allen Upload-Endpoints (media_utils.py)
- ffmpeg im Docker-Image, Video-Thumbnails (extract_video_thumb, poster-Attribut)
- Google Analytics entfernt, Umami self-hosted eingebunden (index.html, datenschutz.js)
- Admin-Panel Analytics-Tab: Stat-Cards, Sparkline 7 Tage, Top-Seiten (Umami-API-Proxy)
- Admin-Panel Tab-Icons korrigiert (aus vorhandenem Phosphor-Sprite)
- users.real_name Spalte: Username öffentlich, echter Name privat und optional
- Registrierung: Label "Benutzername", Leerzeichen verboten, Profanity-Blockliste
- Datenschutzerklärung: GA-Abschnitt durch Umami-Text ersetzt

backend/routes/routen.py

@@ -8,6 +8,7 @@ from typing import Optional, List
 from database import db
 from auth import get_current_user, get_current_user_optional
 from routes.achievements import update_streak, check_and_award
+from media_utils import convert_media
 from routes.push import send_push_to_user
 
 router = APIRouter()
@@ -344,12 +345,14 @@ async def add_route_photo(
     if dict(row)['user_id'] != user['id']:
         raise HTTPException(403, "Nicht berechtigt.")
 
-    ext      = os.path.splitext(file.filename or "")[1] or ".jpg"
+    data, ext = convert_media(await file.read(), file.filename or "")
+    if not ext:
+        ext = ".jpg"
     filename = f"route_{route_id}_{uuid.uuid4().hex[:8]}{ext}"
     path     = os.path.join(MEDIA_DIR, "routes", filename)
     os.makedirs(os.path.dirname(path), exist_ok=True)
     with open(path, "wb") as f:
-        f.write(await file.read())
+        f.write(data)
 
     foto_url = f"/media/routes/{filename}"
     with db() as conn: