feat: overhaul with modular API, agent endpoints, migrations, backup and tests

- Split monolithic app.py into server/api/ routers
- Add Pydantic schemas for input validation
- Add /agent/* API with separate AGENT_TOKEN auth
- Replace static schema.sql with versioned migrations (datenerhaltend)
- Add tools/backup_db.py for SQLite backups
- Add Dockerfile HEALTHCHECK and compose.yml AGENT_TOKEN env
- Add pytest tests for user and agent API
- Update README with API docs and deployment safety notes
- Bump version to 1.2.0

server/api/auth.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, HTTPException
+from fastapi.responses import JSONResponse
+
+from server.auth import create_token, verify_pin
+from server.schemas import PinLogin
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+logger = logging.getLogger(__name__)
+
+NO_STORE = {"Cache-Control": "no-store"}
+
+
+@router.post("/pin")
+async def auth_pin(payload: PinLogin) -> JSONResponse:
+    if not verify_pin(payload.pin):
+        logger.warning("Failed PIN login attempt")
+        raise HTTPException(status_code=401, detail="Falscher PIN. Dein Gehirn auch.")
+    return JSONResponse({"token": create_token()}, headers=NO_STORE)