API-Reife: Scopes (read/write), Rate-Limit pro Key, OpenAPI-Spec

- ApiKey::hasScope + checkRateLimit (Fixed-Window/min via api_key_hits)
- bootstrap erzwingt Rate-Limit (429) und api_require_scope() in Endpunkten
- admin/api_keys.php: Scope-Auswahl + Limit beim Erstellen, Anzeige in Tabelle
- api/openapi.php: OpenAPI-3.0-Spec (Import in Postman/Swagger)
- Schema 0003 (api_keys.scope, api_keys.rate_limit, Tabelle api_key_hits)

api/bootstrap.php

@@ -37,3 +37,17 @@ $apiKeyRow = ApiKey::verify(ApiKey::fromRequest(), $db);
 if (!$apiKeyRow) {
     api_json(['error' => 'unauthorized', 'message' => 'Gültiger API-Schlüssel erforderlich (Authorization: Bearer …)'], 401);
 }
+
+// Rate-Limit pro Schlüssel
+if (!ApiKey::checkRateLimit($apiKeyRow, $db)) {
+    header('Retry-After: 60');
+    api_json(['error' => 'rate_limited', 'message' => 'Rate-Limit überschritten. Bitte später erneut versuchen.'], 429);
+}
+
+/** Erzwingt einen Scope für den aktuellen Schlüssel. */
+function api_require_scope($needed) {
+    global $apiKeyRow;
+    if (!ApiKey::hasScope($apiKeyRow, $needed)) {
+        api_json(['error' => 'forbidden', 'message' => "Schlüssel hat keinen '$needed'-Scope"], 403);
+    }
+}