feat: DELETE /transcripts/{filename} — delete transcript with path-confinement check

api/router.py

@@ -134,6 +134,18 @@ async def get_transcript(filename: str, user: dict = Depends(current_user)):
     return PlainTextResponse(content)
 
 
+@router.delete("/transcripts/{filename}")
+async def delete_transcript(filename: str, user: dict = Depends(current_user)):
+    user_dir = os.path.join(user["output_dir"], user["username"])
+    if os.path.basename(filename) != filename or not filename.endswith(".md"):
+        raise HTTPException(status_code=404, detail="Nicht gefunden")
+    path = os.path.join(user_dir, filename)
+    if not os.path.exists(path):
+        raise HTTPException(status_code=404, detail="Nicht gefunden")
+    os.unlink(path)
+    return {"ok": True}
+
+
 @router.get("/config")
 async def get_config(user: dict = Depends(current_user)):
     return load_config()