refactor: split sqlite.go and server.go by domain (FLAW-20)

Pure moves, no behaviour change: the storage layer now has users,
apikeys, thoughts, tasklists, documents, folders, tags, lists, teams and
system files next to sqlite.go (store, schema, migrations); the API has
handlers_*.go per area plus realtime.go and alarms.go next to server.go
(server, router, middleware). Declarations were moved verbatim with an
AST-based tool; imports pruned with goimports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_integrations.go

@@ -0,0 +1,144 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/sandrodach/mindsift/internal/auth"
+)
+
+// --- API KEYS & WEBHOOK INGESTION ---
+
+func (s *Server) handleGetAPIKeys(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	keys, err := s.store.GetAPIKeys(userID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, keys)
+}
+
+func (s *Server) handleCreateAPIKey(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	var req struct {
+		Name string `json:"name"`
+	}
+	_ = json.NewDecoder(r.Body).Decode(&req)
+
+	key, err := s.store.CreateAPIKey(userID, req.Name)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusCreated, key)
+}
+
+func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	keyID := chi.URLParam(r, "id")
+	if err := s.store.DeleteAPIKey(userID, keyID); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
+}
+
+// handleWebhookIngest accepts Smarthome / External automation webhooks via ?token=... or X-API-Key or Bearer token
+func (s *Server) handleWebhookIngest(w http.ResponseWriter, r *http.Request) {
+	token := r.URL.Query().Get("token")
+	if token == "" {
+		token = r.Header.Get("X-API-Key")
+	}
+	if token == "" && strings.HasPrefix(r.Header.Get("Authorization"), "Bearer ") {
+		token = strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	}
+
+	// Same checks as every other request (revoked/outdated sessions, inactive accounts)
+	user, _ := s.authenticateToken(token)
+	if user == nil {
+		writeError(w, http.StatusUnauthorized, "Ungültiger Webhook-Token oder API-Key")
+		return
+	}
+
+	var req struct {
+		Title    string   `json:"title"`
+		Content  string   `json:"content"`
+		Text     string   `json:"text"`
+		Message  string   `json:"message"`
+		Priority string   `json:"priority"`
+		Source   string   `json:"source"`
+		Tags     []string `json:"tags"`
+		DueDate  string   `json:"dueDate"`
+		DueDate2 string   `json:"due_date"`
+	}
+
+	bodyBytes, _ := io.ReadAll(r.Body)
+	if len(bodyBytes) > 0 {
+		if jsonErr := json.Unmarshal(bodyBytes, &req); jsonErr != nil {
+			plain := strings.TrimSpace(string(bodyBytes))
+			if plain != "" {
+				req.Content = plain
+			}
+		}
+	}
+
+	if req.Content == "" {
+		if req.Text != "" {
+			req.Content = req.Text
+		} else if req.Message != "" {
+			req.Content = req.Message
+		}
+	}
+
+	dueDate := req.DueDate
+	if dueDate == "" {
+		dueDate = req.DueDate2
+	}
+
+	bodyText := strings.TrimSpace(req.Title)
+	if req.Content != "" {
+		if bodyText != "" {
+			bodyText = bodyText + " — " + strings.TrimSpace(req.Content)
+		} else {
+			bodyText = strings.TrimSpace(req.Content)
+		}
+	}
+	if bodyText == "" {
+		writeError(w, http.StatusBadRequest, "Feld 'title', 'content', 'text' oder 'message' ist erforderlich")
+		return
+	}
+
+	for _, tag := range req.Tags {
+		cleanTag := strings.TrimPrefix(strings.TrimSpace(tag), "#")
+		if cleanTag != "" && !strings.Contains(strings.ToLower(bodyText), "#"+strings.ToLower(cleanTag)) {
+			bodyText += fmt.Sprintf(" #%s", cleanTag)
+		}
+	}
+
+	if req.Priority == "" {
+		req.Priority = "high"
+	}
+
+	source := strings.ToLower(strings.TrimSpace(req.Source))
+	if source == "" {
+		source = "webhook"
+	}
+
+	thought, err := s.store.CreateThought(user.ID, bodyText, req.Priority, source, dueDate)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	s.wsHub.BroadcastToUsers(s.taskAudience(thought), "TASK_CREATED", thought)
+
+	writeJSON(w, http.StatusCreated, map[string]interface{}{
+		"status":  "ingested",
+		"thought": thought,
+	})
+}