legal/web: Zustimmungsgate je Dokumentversion (aus bis AGB 0.7), OG-Variante mit eingebranntem Bildnachweis, Nachweis in Teasern (Bildkennzeichnung Blöcke G und H)

- legal_document_acceptances (insert-only), LegalAcceptanceGate, Pflicht-Schalter im Einreichungs-Modal über den gemeinsamen Trait; API: GET/POST /api/v1/legal/acceptances, submit antwortet 428 mit den geforderten Fassungen; LEGAL_ACCEPTANCE_GATE
- ImageService: og-Variante (1200×630) mit halbtransparentem Balken und Inter SemiBold, regenerateOgVariant() für Korrekturen und Bestand; Fokuspunkt/Letterbox getestet
- Uploader brennt den Nachweis beim Upload ein, ImageCorrectionService baut die OG-Variante nach einer Korrektur neu; Artikelseite nutzt og für og:image
- Teaser: Nachweis in alt/title (Feed, Hero, Kategorie, Newsroom), Unterschrift am Hero-Bild; PressRelease::cardImageCredit()

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

app/Http/Controllers/Api/V1/LegalAcceptanceController.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Models\LegalDocument;
+use App\Models\LegalDocumentAcceptance;
+use App\Services\Legal\LegalAcceptanceGate;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+
+/**
+ * Zustimmungsgate per API (Block G, O2): einmal je Kontoinhaber und
+ * Dokumentversion. Ohne gültige Annahme antwortet POST …/submit mit 428
+ * und den geforderten Fassungen.
+ */
+class LegalAcceptanceController extends Controller
+{
+    public function __construct(private readonly LegalAcceptanceGate $gate) {}
+
+    public function index(Request $request): JsonResponse
+    {
+        $required = $this->gate->requiredFor($request->user())->map(fn (LegalDocument $d) => $this->gate->describe($d))->values();
+
+        return response()->json([
+            'gate_enabled' => $this->gate->isEnabled(),
+            'required' => $required,
+            'accepted' => LegalDocumentAcceptance::query()
+                ->where('user_id', $request->user()->getKey())
+                ->orderByDesc('id')
+                ->limit(20)
+                ->get(['type', 'version', 'context', 'accepted_at'])
+                ->map(fn (LegalDocumentAcceptance $a) => ['type' => $a->type, 'version' => $a->version, 'context' => $a->context, 'accepted_at' => $a->accepted_at->toIso8601String()])
+                ->values(),
+        ]);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        abort_unless($request->user()->tokenCan('press-releases:write'), 403);
+
+        $validated = $request->validate([
+            'documents' => ['required', 'array', 'min:1'],
+            'documents.*.type' => ['required', Rule::in(LegalAcceptanceGate::TYPES)],
+            'documents.*.version' => ['required', 'string', 'max:10'],
+        ]);
+
+        $documents = [];
+
+        foreach ($validated['documents'] as $item) {
+            $current = LegalDocument::current($item['type']);
+
+            if ($current === null || $current->version !== $item['version']) {
+                return response()->json([
+                    'message' => sprintf('Version %s of %s is not the current one (current: %s).', $item['version'], $item['type'], $current !== null ? $current->version : 'none'),
+                ], 422);
+            }
+
+            $documents[] = $current;
+        }
+
+        $this->gate->accept($request->user(), $documents, LegalDocumentAcceptance::CONTEXT_API, $request->ip(), $request->userAgent());
+
+        return $this->index($request)->setStatusCode(201);
+    }
+}

app/Http/Controllers/Api/V1/PressReleaseController.php

@@ -14,6 +14,7 @@ use App\Models\Category;
 use App\Models\Company;
 use App\Models\PressRelease;
 use App\Scopes\PortalScope;
+use App\Services\Legal\LegalAcceptanceGate;
 use App\Services\PressRelease\AiDeclarationRequiredException;
 use App\Services\PressRelease\BlacklistViolationException;
 use App\Services\PressRelease\BookingRequiredException;
@@ -208,6 +209,18 @@ class PressReleaseController extends Controller
             ], 409);
         }
 
+        // Zustimmungsgate (Block G, O2): ohne Annahme der aktuellen AGB- und
+        // Richtlinien-Fassung 428 mit den geforderten Versionen.
+        $gate = app(LegalAcceptanceGate::class);
+        $requiredDocuments = $gate->requiredFor($request->user());
+
+        if ($requiredDocuments->isNotEmpty()) {
+            return response()->json([
+                'message' => 'The current terms and guidelines must be accepted before submitting (POST /api/v1/legal/acceptances).',
+                'required_documents' => $requiredDocuments->map(fn ($document) => $gate->describe($document))->values(),
+            ], 428);
+        }
+
         $pressRelease->update([
             'ai_text_declaration' => $validated['ai_text_declaration'],
             'ai_declaration_confirmed_at' => now(),