feat: HA-Entitaeten fuer Push-Erinnerungen und Kanban; neues Feature Sidebar-Sichtbarkeit pro Nutzer

backend/src/routes/admin.js

@@ -32,7 +32,7 @@ router.post('/restore', authenticate, requireAdmin, upload.single('database'), (
 // GET /api/admin/users – alle Benutzer mit Statistiken
 router.get('/users', authenticate, requireAdmin, (req, res) => {
   const users = db.prepare(`
-    SELECT u.id, u.username, u.role, u.created_at, u.last_active_at, u.hidden,
+    SELECT u.id, u.username, u.role, u.created_at, u.last_active_at, u.hidden, u.hidden_tools,
       CASE WHEN p.user_id IS NOT NULL THEN 1 ELSE 0 END as has_pushover
     FROM users u
     LEFT JOIN pushover_settings p ON p.user_id = u.id
@@ -47,7 +47,9 @@ router.get('/users', authenticate, requireAdmin, (req, res) => {
     const files      = db.prepare('SELECT COUNT(*) c FROM files WHERE user_id=?').get(u.id).c;
     const noteLen    = (db.prepare('SELECT content FROM notes WHERE user_id=?').get(u.id)?.content || '').length;
     const icals      = db.prepare('SELECT COUNT(*) c FROM calendar_feeds WHERE user_id=?').get(u.id).c;
-    return { ...u, archiv, bestellung, snippets_c, todos, links, files, icals, noteLen };
+    let hidden_tools = [];
+    try { hidden_tools = JSON.parse(u.hidden_tools || '[]'); } catch {}
+    return { ...u, hidden_tools, archiv, bestellung, snippets_c, todos, links, files, icals, noteLen };
   });
   res.json(stats);
 });
@@ -170,6 +172,18 @@ router.put('/users/:id/hidden', authenticate, requireAdmin, (req, res) => {
   res.json({ hidden: newHidden });
 });
 
+// PUT /api/admin/users/:id/hidden-tools – Sidebar-Sichtbarkeit für einen User setzen
+// body: { hidden_tools: ['schocken', 'paywallkiller', ...] } (tool-ids aus toolRegistry.js)
+router.put('/users/:id/hidden-tools', authenticate, requireAdmin, (req, res) => {
+  const user = db.prepare('SELECT * FROM users WHERE id=?').get(req.params.id);
+  if (!user) return res.status(404).json({ error: 'Nicht gefunden' });
+  const { hidden_tools } = req.body;
+  if (!Array.isArray(hidden_tools)) return res.status(400).json({ error: 'hidden_tools muss ein Array sein' });
+  const cleaned = [...new Set(hidden_tools.filter(t => typeof t === 'string'))];
+  db.prepare('UPDATE users SET hidden_tools=? WHERE id=?').run(JSON.stringify(cleaned), user.id);
+  res.json({ hidden_tools: cleaned });
+});
+
 // Test-Pushover an beliebigen User senden
 router.post('/users/:id/test-push', authenticate, requireAdmin, async (req, res) => {
   const user = db.prepare('SELECT * FROM users WHERE id=?').get(req.params.id);