Rebuild profile router as secure recoverable v2

deploy/install.sh

@@ -38,7 +38,10 @@ fi
 
 # --- 2. Neue Dateien installieren -------------------------------------------
 mkdir -p "$INSTALL_DIR" "$IMAGE_DIR"
+install -d -m 0700 /etc/mike-ai /var/lib/mike-ai-profile-router
 install -m 0755 "$DIR/ai_profile_router.py" "$INSTALL_DIR/ai_profile_router.py"
+install -m 0644 "$DIR/router_support.py" "$INSTALL_DIR/router_support.py"
+install -m 0644 "$DIR/router_profiles.json" /etc/mike-ai/router-profiles.json
 install -m 0755 "$DIR/image_worker.py" "$INSTALL_DIR/image_worker.py"
 install -m 0755 "$DIR/xtts_worker.py" "$INSTALL_DIR/xtts_worker.py"
 install -m 0755 "$DIR/stt_worker.py" "$INSTALL_DIR/stt_worker.py"
@@ -46,6 +49,14 @@ install -m 0644 "$DIR/${SERVICE}" "/etc/systemd/system/${SERVICE}"
 install -m 0644 "$DIR/${XTTS_SERVICE}" "/etc/systemd/system/${XTTS_SERVICE}"
 install -m 0644 "$DIR/${WHISPER_SERVICE}" "/etc/systemd/system/${WHISPER_SERVICE}"
 
+# Eigener Router-Key. Er wird niemals in Git oder ins Installationslog geschrieben.
+if [ ! -s /etc/mike-ai/router-api-key ]; then
+  umask 077
+  python3 -c 'import secrets; print(secrets.token_urlsafe(48))' \
+    > /etc/mike-ai/router-api-key
+fi
+chmod 0600 /etc/mike-ai/router-api-key
+
 # --- 3. Python-Venv mit Bild-Abhängigkeiten ---------------------------------
 if [ ! -x "$VENV/bin/python" ]; then
   echo "-- Erstelle Python-Venv in $VENV"
@@ -150,5 +161,17 @@ if ! systemctl is-active --quiet "$WHISPER_SERVICE"; then
   exit 1
 fi
 echo "-- Whisper-Service läuft"
-curl -sf "http://127.0.0.1:8081/status" | python3 -m json.tool
+python3 - <<'PY'
+import json
+import pathlib
+import urllib.request
+
+key = pathlib.Path("/etc/mike-ai/router-api-key").read_text().strip()
+request = urllib.request.Request(
+    "http://127.0.0.1:8081/status",
+    headers={"Authorization": f"Bearer {key}"})
+with urllib.request.urlopen(request, timeout=10) as response:
+    print(json.dumps(json.load(response), indent=2))
+PY
+echo "-- Router-API-Key liegt ausschließlich in /etc/mike-ai/router-api-key"
 echo "== Fertig =="