Feature: Partner-Profile Backend + Pro-Zugang für Partner

Die Partner-Showcase-Seite (#partner) und der Profil-Editor (#partner-profil)
existierten seit v1102 nur als Frontend — /api/partners/public und
/api/partner/my-profile gab es nie (vermutlich Worktree-Merge-Verlust).

Backend neu:
- partner_profiles-Tabelle (user_id PK, ON DELETE CASCADE → DSGVO-Delete greift)
- GET/PUT /partner/my-profile (Texte, Website-Normalisierung, @-Instagram)
- Logo-Upload (≤5 MB → WebP 512px, altes Logo wird geräumt)
- Foto/Video-Upload (max 6, 200-MB-Budget, HEIC→JPEG, MOV→MP4 via ffmpeg,
  Bilder→WebP 1600px) + Lösch-Endpoint
- Submit-Workflow (approved 0/1/-1) + Admin-Mail (best effort)
- GET /partners/public (nur freigegebene, JOIN users für Name/Avatar)
- Admin: GET /admin/partner/profiles + POST .../review

Pro für Partner: has_pro_access() + App._hasPro() prüfen jetzt is_partner —
Multiplikatoren bekommen Pro gratis (mehrere Hunde, KI-Trainer etc.).

UI: Admin-Partner-Tab mit Freigabe-Sektion (offen-Badge, ✓/✗),
Settings zeigt Partnern eine Karte mit Link zum Profil-Editor.

Tests: tests/test_partner_profile.py — 5 Smoke-Tests (403, Voll-Flow
inkl. Freigabe/Ablehnung, Pflicht-Anzeigename, Logo+Foto-Upload, Pro-Zugang).
Suite: 44 passed.

backend/static/js/pages/admin.js

@@ -2289,7 +2289,8 @@ window.Page_admin = (() => {
   // TAB: AUDIT-LOG
   // ------------------------------------------------------------------
   async function _renderPartner(el) {
-    const codes = (await API.get('/admin/partner/codes')) || [];
+    const codes    = (await API.get('/admin/partner/codes')) || [];
+    const profiles = (await API.get('/admin/partner/profiles').catch(() => [])) || [];
 
     el.innerHTML = `
       <div style="display:flex;flex-direction:column;gap:var(--space-5)">
@@ -2383,6 +2384,36 @@ window.Page_admin = (() => {
           </div>
         </div>
 
+        <!-- Partner-Profil-Freigaben -->
+        <div class="by-card p-4">
+          <h3 style="margin:0 0 var(--space-3);font-size:var(--text-base)">
+            Profil-Freigaben
+            ${profiles.filter(p => p.submitted_at && p.approved === 0).length
+              ? `<span class="badge" style="background:var(--c-warning,#f59e0b);color:#fff;margin-left:var(--space-2)">${profiles.filter(p => p.submitted_at && p.approved === 0).length} offen</span>` : ''}
+          </h3>
+          ${profiles.length === 0
+            ? `<p class="text-sm-muted">Noch keine Partner-Profile angelegt.</p>`
+            : profiles.map(p => `
+              <div style="display:flex;align-items:center;gap:var(--space-3);padding:var(--space-2) 0;border-bottom:1px solid var(--c-border)" data-pp-uid="${p.user_id}">
+                ${p.logo_url
+                  ? `<img src="${UI.escape(p.logo_url)}" style="width:36px;height:36px;border-radius:var(--radius-md);object-fit:contain;background:var(--c-surface-2);flex-shrink:0">`
+                  : `<div style="width:36px;height:36px;border-radius:var(--radius-md);background:var(--c-surface-2);flex-shrink:0"></div>`}
+                <div class="flex-1-min">
+                  <div style="font-weight:600;font-size:var(--text-sm)">${UI.escape(p.display_name || p.name)}</div>
+                  <div class="text-xs-muted">${UI.escape(p.name)} · ${UI.escape(p.email)}${p.photos?.length ? ` · ${p.photos.length} Medien` : ''}</div>
+                </div>
+                ${p.approved === 1
+                  ? `<span class="badge" style="background:#dcfce7;color:#16a34a">✓ Frei</span>`
+                  : p.approved === -1
+                  ? `<span class="badge" style="background:#fee2e2;color:#dc2626">✗ Abgelehnt</span>`
+                  : p.submitted_at
+                  ? `<span class="badge" style="background:#fef9c3;color:#a16207">⏳ Prüfen</span>`
+                  : `<span class="badge">Entwurf</span>`}
+                ${p.approved !== 1 ? `<button class="btn btn-sm btn-primary adm-pp-review" data-uid="${p.user_id}" data-val="1">✓</button>` : ''}
+                ${p.approved !== -1 ? `<button class="btn btn-sm btn-ghost adm-pp-review text-danger" data-uid="${p.user_id}" data-val="-1">✗</button>` : ''}
+              </div>`).join('')}
+        </div>
+
         <!-- User-Status vergeben -->
         <div class="by-card p-4">
           <h3 style="margin:0 0 var(--space-3);font-size:var(--text-base)">Nutzer-Status manuell vergeben</h3>
@@ -2414,6 +2445,18 @@ window.Page_admin = (() => {
       </div>
     `;
 
+    // Partner-Profil freigeben / ablehnen
+    el.querySelectorAll('.adm-pp-review').forEach(btn => {
+      btn.addEventListener('click', async () => {
+        try {
+          await API.post(`/admin/partner/profiles/${btn.dataset.uid}/review`,
+                         { approved: parseInt(btn.dataset.val) });
+          UI.toast.success(btn.dataset.val === '1' ? 'Profil freigegeben.' : 'Profil abgelehnt.');
+          await _renderPartner(el);
+        } catch (err) { UI.toast.error(err.message); }
+      });
+    });
+
     // Code erstellen
     el.querySelector('#adm-partner-create')?.addEventListener('submit', async e => {
       e.preventDefault();