fix: media – requireAdmin korrekt, Header, Token-Hinweis

backend/src/tools/media/routes.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const router  = express.Router();
 const db      = require('../../db');
+const { requireAdmin } = require('../../middleware/auth');
 
 const TMDB_BASE = 'https://api.themoviedb.org/3';
 
@@ -71,16 +72,14 @@ router.delete('/favorites/:tmdb_id', (req, res) => {
   res.json({ ok: true });
 });
 
-// GET /api/tools/media/settings  (admin only – gibt Token maskiert zurück)
-router.get('/settings', (req, res) => {
-  if (!req.user.is_admin) return res.status(403).json({ error: 'Nur Admin' });
+// GET /api/tools/media/settings  (admin only)
+router.get('/settings', requireAdmin, (req, res) => {
   const token = getToken();
   res.json({ configured: !!token });
 });
 
 // PUT /api/tools/media/settings  (admin only)
-router.put('/settings', (req, res) => {
-  if (!req.user.is_admin) return res.status(403).json({ error: 'Nur Admin' });
+router.put('/settings', requireAdmin, (req, res) => {
   const { tmdb_token } = req.body;
   if (typeof tmdb_token !== 'string') return res.status(400).json({ error: 'tmdb_token fehlt' });
   db.prepare('INSERT OR REPLACE INTO admin_settings (key,value) VALUES (?,?)').run('tmdb_token', tmdb_token.trim());