Add multi-user support with export feature

- New users table (migration 004) with user_id on exercises, training_sets, sessions
- User CRUD endpoints (GET/POST /api/v1/users, DELETE /api/v1/users/{id})
- All existing endpoints scoped to X-User-ID header
- CSV export endpoint (GET /api/v1/export) for completed sessions
- UserGate in PageShell: blocks app until a user is selected
- Settings page for managing users (create, switch, delete)
- BottomNav/Sidebar updated with settings navigation
- Fix: nil pointer panic in handleDeleteUser on success path
- Fix: export download now uses fetch with X-User-ID header instead of window.location.href

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/handler/user.go

@@ -0,0 +1,59 @@
+package handler
+
+import (
+	"database/sql"
+	"krafttrainer/internal/model"
+	"net/http"
+	"strings"
+)
+
+func (h *Handler) handleListUsers(w http.ResponseWriter, r *http.Request) {
+	users, err := h.store.ListUsers()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "Fehler beim Laden der Nutzer")
+		return
+	}
+	writeJSON(w, http.StatusOK, users)
+}
+
+func (h *Handler) handleCreateUser(w http.ResponseWriter, r *http.Request) {
+	var req model.CreateUserRequest
+	if err := decodeJSON(r, &req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiger Request-Body")
+		return
+	}
+	if err := req.Validate(); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	user, err := h.store.CreateUser(req.Name)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "Fehler beim Erstellen des Nutzers")
+		return
+	}
+	writeJSON(w, http.StatusCreated, user)
+}
+
+func (h *Handler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
+	id, err := pathID(r, "id")
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültige ID")
+		return
+	}
+
+	err = h.store.DeleteUser(id)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			writeError(w, http.StatusNotFound, "Nutzer nicht gefunden")
+			return
+		}
+		if strings.Contains(err.Error(), "LAST_USER") {
+			writeError(w, http.StatusConflict, "Der letzte Nutzer kann nicht gelöscht werden")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "Fehler beim Löschen des Nutzers")
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}