feat(admin): LicServer config manageable via admin settings UI

- Migration: add licserver_base_url/api_key cols to settings table
- New: lib/actions/licserver-config.ts (read/write/test server actions)
- Updated: proxy routes read config from DB with env-var fallback
- Updated: admin/einstellungen adds LicServer card with URL + API key
  input, show/hide toggle, Save and Connection Test buttons

shop/lib/actions/licserver-config.ts

@@ -0,0 +1,86 @@
+'use server'
+
+import { createClient } from '@/lib/supabase/server'
+
+export interface LicServerConfig {
+  base_url: string | null
+  api_key:  string | null
+}
+
+/**
+ * Read LicServer config from the settings table (admin only).
+ * Falls back to environment variables if DB values are empty.
+ */
+export async function getLicServerConfig(): Promise<LicServerConfig> {
+  const supabase = await createClient()
+
+  const { data } = await supabase
+    .from('settings')
+    .select('licserver_base_url, licserver_api_key')
+    .eq('id', 'licserver')
+    .single()
+
+  return {
+    base_url: data?.licserver_base_url || process.env.LICSERVER_BASE_URL || null,
+    api_key:  data?.licserver_api_key  || process.env.LICSERVER_API_KEY  || null,
+  }
+}
+
+/**
+ * Save LicServer config. Admin-only — checks role before writing.
+ */
+export async function saveLicServerConfig(
+  base_url: string,
+  api_key:  string
+): Promise<{ success: boolean; error?: string }> {
+  const supabase = await createClient()
+
+  // Auth + role check
+  const { data: { user } } = await supabase.auth.getUser()
+  if (!user) return { success: false, error: 'Nicht angemeldet' }
+
+  const { data: userData } = await supabase
+    .from('users')
+    .select('role')
+    .eq('id', user.id)
+    .single()
+
+  if (!userData || !['admin', 'superadmin'].includes(userData.role)) {
+    return { success: false, error: 'Keine Berechtigung' }
+  }
+
+  const { error } = await supabase
+    .from('settings')
+    .upsert({
+      id:                  'licserver',
+      licserver_base_url:  base_url.trim() || null,
+      licserver_api_key:   api_key.trim()  || null,
+      updated_at:          new Date().toISOString(),
+    })
+
+  if (error) return { success: false, error: error.message }
+  return { success: true }
+}
+
+/**
+ * Test the connection with current config.
+ * Calls GET /api-v1/partners?pageSize=1 and returns true if 200.
+ */
+export async function testLicServerConnection(): Promise<{ ok: boolean; message: string }> {
+  const cfg = await getLicServerConfig()
+
+  if (!cfg.base_url || !cfg.api_key) {
+    return { ok: false, message: 'URL oder API-Key nicht konfiguriert' }
+  }
+
+  try {
+    const res = await fetch(`${cfg.base_url}/api-v1/partners?pageSize=1`, {
+      headers: { 'X-Api-Key': cfg.api_key, Accept: 'application/json' },
+      signal: AbortSignal.timeout(5_000),
+    })
+    if (res.ok) return { ok: true,  message: `Verbindung OK (HTTP ${res.status})` }
+    return { ok: false, message: `LicServer antwortete mit HTTP ${res.status}` }
+  } catch (err: any) {
+    return { ok: false, message: `Nicht erreichbar: ${err.message}` }
+  }
+}