feat: Tage als geschlossen markierbar (Feiertage o. Ä.)

Im Wochenplan lässt sich pro Tag ein optionaler, mehrsprachiger
Schließungsgrund hinterlegen. Geschlossene Tage werden auf der
öffentlichen Speisekarte (Desktop + mobil) und im RSS-Feed als
"Geschlossen" statt mit Essenszeiten angezeigt, im Wochenplan bleibt
"Mahlzeit hinzufügen" für diesen Tag deaktiviert.

app/api/closed-days/[date]/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { removeClosedDay } from "@/lib/db/closed-days";
+import { authErrorResponse, requireRole } from "@/lib/auth/session";
+import { isSameOrigin } from "@/lib/origin";
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: Promise<{ date: string }> }
+) {
+  if (!isSameOrigin(request)) {
+    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
+  }
+  try {
+    await requireRole(["staff", "admin"]);
+    const { date } = await params;
+    await removeClosedDay(date);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    const res = authErrorResponse(err);
+    if (res) return res;
+    throw err;
+  }
+}

app/api/closed-days/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from "next/server";
+import { listClosedDays, setClosedDay } from "@/lib/db/closed-days";
+import { authErrorResponse, requireRole } from "@/lib/auth/session";
+import { isSameOrigin } from "@/lib/origin";
+
+export async function GET(request: Request) {
+  const { searchParams } = new URL(request.url);
+  const from = searchParams.get("from");
+  const to = searchParams.get("to");
+  if (!from || !to) {
+    return NextResponse.json({ error: "invalid_input" }, { status: 400 });
+  }
+  return NextResponse.json(await listClosedDays(from, to));
+}
+
+export async function POST(request: Request) {
+  if (!isSameOrigin(request)) {
+    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
+  }
+  try {
+    await requireRole(["staff", "admin"]);
+    const body = (await request.json()) as {
+      closed_date: string;
+      reason: string | null;
+      translations?: Record<string, string | null>;
+    };
+    const closedDay = await setClosedDay(body.closed_date, body.reason, body.translations);
+    return NextResponse.json(closedDay, { status: 201 });
+  } catch (err) {
+    const res = authErrorResponse(err);
+    if (res) return res;
+    throw err;
+  }
+}