Multi-Modell + Vision: OpenRouter (GLM 5.3 Flash), Bild-Upload, Tour-Feature, Dashboard-Fixes

- Modell-Registry (DeepSeek direkt + OpenRouter z-ai/glm-5.3-flash), Modellwahl pro Session, Reasoning-Effort max (env-konfigurierbar)
- Bild-Upload für Vision-Modelle (User) + Agent-screenshot()-Tool (nur Vision)
- Tour-Planung: geocode + save_tour mit GPX-Export und Karten-Sektion
- Fix: System-Prompt wird jetzt wirklich an die API gesendet, inkl. aktuellem Dashboard-Dateinamen für Folge-Updates
- Fix: History-Sanitizer gegen 400-Fehler (nie mitten in Tool-Gruppen kürzen)
- Fix: reasoning_content-Roundtrip (Pflicht bei DeepSeek mit tools)
- Fix: Dashboards ohne Browser-Cache ausliefern

lib/config.js

@@ -51,15 +51,70 @@ const vapid = ensureVapidPair();
 const config = {
   port: Number(process.env.PORT || env.PORT || 3000),
   apiKey: process.env.DEEPSEEK_API_KEY || env.DEEPSEEK_API_KEY || '',
+  openrouterApiKey: process.env.OPENROUTER_API_KEY || env.OPENROUTER_API_KEY || '',
   appPassword: process.env.APP_PASSWORD || env.APP_PASSWORD || '',
   model: process.env.MODEL || env.MODEL || 'deepseek-v4-flash',
   thinking: process.env.THINKING || env.THINKING || 'enabled',
+  maxTokens: Number(process.env.MAX_TOKENS || env.MAX_TOKENS || 64000),
   baseUrl: process.env.DEEPSEEK_BASE_URL || env.DEEPSEEK_BASE_URL || 'https://api.deepseek.com',
   loginMaxAttempts: Number(process.env.LOGIN_MAX_ATTEMPTS || env.LOGIN_MAX_ATTEMPTS || 5),
   loginLockMinutes: Number(process.env.LOGIN_LOCK_MINUTES || env.LOGIN_LOCK_MINUTES || 5),
+  nominatimEmail: process.env.NOMINATIM_EMAIL || env.NOMINATIM_EMAIL || '',
+  osrmUrl: process.env.OSRM_URL || env.OSRM_URL || 'https://router.project-osrm.org',
   sessionSecret: ensure('SESSION_SECRET', () => crypto.randomBytes(32).toString('hex')),
   vapidPublicKey: vapid.publicKey,
   vapidPrivateKey: vapid.privateKey,
 };
 
-module.exports = { config };
+const envOr = (key, def) => process.env[key] || env[key] || def;
+
+// ---------------------------------------------------------------------------
+// Modell-Registry: DeepSeek direkt + OpenRouter-Modelle (z.B. GLM 5.3 Flash)
+// ---------------------------------------------------------------------------
+
+const MODELS = [
+  {
+    id: 'deepseek-v4-flash',
+    label: 'DeepSeek V4 Flash',
+    provider: 'deepseek',
+    vision: false,
+    maxTokens: 64000,
+    reasoningEffort: () => envOr('DEEPSEEK_REASONING_EFFORT', 'max'),
+    prices: { inputCacheHit: 0.014, inputCacheMiss: 0.44, output: 1.32 },
+  },
+  {
+    id: 'z-ai/glm-5.3-flash',
+    label: 'GLM 5.3 Flash (OpenRouter)',
+    provider: 'openrouter',
+    vision: true,
+    maxTokens: 64000,
+    reasoningEffort: () => envOr('GLM_REASONING_EFFORT', 'max'),
+    prices: { inputCacheHit: 0.015, inputCacheMiss: 0.075, output: 0.25 },
+    costNote: 'Schätzung (OpenRouter, Rabatt bis Sep 2026)',
+  },
+];
+
+/** Registry inkl. benutzerdefiniertem Modell aus der Env (MODEL), falls nicht bekannt. */
+function getModels() {
+  if (MODELS.some((m) => m.id === config.model)) return MODELS;
+  return [
+    ...MODELS,
+    {
+      id: config.model,
+      label: config.model,
+      provider: 'deepseek',
+      vision: false,
+      maxTokens: config.maxTokens,
+      reasoningEffort: () => envOr('DEEPSEEK_REASONING_EFFORT', 'max'),
+      prices: { inputCacheHit: 0.014, inputCacheMiss: 0.44, output: 1.32 },
+    },
+  ];
+}
+
+/** Modell per ID auflösen (Fallback: Default-Modell aus Env). */
+function getModel(id) {
+  const models = getModels();
+  return models.find((m) => m.id === id) || models.find((m) => m.id === config.model) || models[0];
+}
+
+module.exports = { config, MODELS, getModels, getModel };