fix(security): harden licserver config access controls

- Add auth guard to getLicServerConfig() - unauthenticated callers
  now receive null config instead of DB values
- Remove non-existent 'superadmin' role from saveLicServerConfig()
  check (only 'admin' exists per project schema)
- New migration: restrict settings table WRITE to admins only
  (previously any authenticated user could overwrite licserver_api_key)

shop/lib/actions/licserver-config.ts

@@ -8,12 +8,17 @@ export interface LicServerConfig {
 }
 
 /**
- * Read LicServer config from the settings table (admin only).
+ * Read LicServer config from the settings table.
  * Falls back to environment variables if DB values are empty.
+ * Returns null config for unauthenticated callers.
  */
 export async function getLicServerConfig(): Promise<LicServerConfig> {
   const supabase = await createClient()
 
+  // Auth guard — never expose config to unauthenticated callers
+  const { data: { user } } = await supabase.auth.getUser()
+  if (!user) return { base_url: null, api_key: null }
+
   const { data } = await supabase
     .from('settings')
     .select('licserver_base_url, licserver_api_key')
@@ -45,8 +50,9 @@ export async function saveLicServerConfig(
     .eq('id', user.id)
     .single()
 
-  if (!userData || !['admin', 'superadmin'].includes(userData.role)) {
-    return { success: false, error: 'Keine Berechtigung' }
+  // Only 'admin' exists in schema — 'superadmin' removed
+  if (!userData || userData.role !== 'admin') {
+    return { success: false, error: 'Keine Berechtigung (nur Admins)' }
   }
 
   const { error } = await supabase