fix 3

server/services/appwriteClient.js

@@ -56,7 +56,7 @@ async function appwriteFetch(path, { method = 'GET', body } = {}) {
 
 /**
  * Appwrite Auth per native fetch (Node 26 + node-appwrite-Agent ist inkompatibel).
- * Session.secret wird serverseitig oft nicht zurückgegeben – userId aus Session nutzen.
+ * session.secret fehlt serverseitig oft – userId aus Session + Users-API.
  */
 export async function loginWithAppwrite(email, password) {
   let session
@@ -66,7 +66,6 @@ export async function loginWithAppwrite(email, password) {
       body: { email, password },
     })
     DEBUG_LOG('appwriteClient.js:session', 'createEmailPasswordSession ok', {
-      hasSecret: Boolean(session?.secret),
       hasUserId: Boolean(session?.userId),
       sessionId: session?.$id || null,
     }, 'H6')
@@ -81,9 +80,6 @@ export async function loginWithAppwrite(email, password) {
   }
 
   if (!session?.userId) {
-    DEBUG_LOG('appwriteClient.js:session', 'no userId in session', {
-      sessionKeys: session ? Object.keys(session).filter((k) => !k.startsWith('provider')) : [],
-    }, 'H6')
     const error = new Error('Appwrite-Session ohne userId.')
     error.status = 500
     throw error
@@ -94,9 +90,17 @@ export async function loginWithAppwrite(email, password) {
     user = await getUserById(session.userId)
     DEBUG_LOG('appwriteClient.js:getUser', 'users.get ok', { userId: user?.$id || null }, 'H6')
   } catch (err) {
-    DEBUG_LOG('appwriteClient.js:getUser', 'users.get fail, fallback', {
-      message: err?.message?.slice(0, 80),
-    }, 'H6')
+    DEBUG_LOG('appwriteClient.js:getUser', 'users.get fail', {
+      message: err?.message?.slice(0, 120),
+      code: err?.code,
+    }, 'H7')
+    if (err?.message?.includes('not authorized')) {
+      const error = new Error(
+        'Server-API-Key: Scope users.read erforderlich (Appwrite Console).'
+      )
+      error.status = 500
+      throw error
+    }
     user = { $id: session.userId, email, name: '' }
   }
 
@@ -104,7 +108,7 @@ export async function loginWithAppwrite(email, password) {
     try {
       await deleteUserSession(session.userId, session.$id)
     } catch {
-      // Portal nutzt eigene Session; Appwrite-Session optional aufräumen
+      // Portal nutzt eigene Cookie-Session
     }
   }