feat: tab navigation in modal (Index/Transkript/Zusammenfassung)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/router.py

@@ -136,7 +136,7 @@ async def get_transcripts(user: dict = Depends(current_user)):
     return list_transcripts(user_dir)
 
 
-@router.get("/transcripts/{filename}")
+@router.get("/transcripts/{filename:path}")
 async def get_transcript(filename: str, user: dict = Depends(current_user)):
     from fastapi.responses import PlainTextResponse
     user_dir = os.path.join(user["output_dir"], user["username"])
@@ -146,7 +146,7 @@ async def get_transcript(filename: str, user: dict = Depends(current_user)):
     return PlainTextResponse(content)
 
 
-@router.post("/transcripts/{filename}/reprocess")
+@router.post("/transcripts/{filename:path}/reprocess")
 async def reprocess_transcript(filename: str, body: dict, user: dict = Depends(current_user)):
     from output import read_transcript
     from fastapi.responses import PlainTextResponse
@@ -175,10 +175,11 @@ async def reprocess_transcript(filename: str, body: dict, user: dict = Depends(c
     return PlainTextResponse(refined)
 
 
-@router.delete("/transcripts/{filename}")
+@router.delete("/transcripts/{filename:path}")
 async def delete_transcript(filename: str, user: dict = Depends(current_user)):
     user_dir = os.path.join(user["output_dir"], user["username"])
-    if os.path.basename(filename) != filename or not filename.endswith(".md"):
+    parts = filename.split("/")
+    if len(parts) > 2 or any(p in (".", "..") or not p for p in parts) or not filename.endswith(".md"):
         raise HTTPException(status_code=404, detail="Nicht gefunden")
     path = os.path.join(user_dir, filename)
     if not os.path.exists(path):