v0.5.0: Add RBAC auth, LLM router, audit logging, output sanitization

- New: auth.py – Role-based access (operator/approver/viewer)
- New: llm_router.py – Configurable primary/fallback provider chain
- New: audit_log.py + audit_query.py – DSGVO-compliant audit trail
- New: sanitize_output() – masks secrets in bot responses
- Updated: bot.py – Integrated auth guards, router, audit logging
- Updated: ollama_client.py – Router-compatible interface
- Updated: CLOWNFISCHSERVER.md – Documentation updated
- Updated: README.md – Documentation updated

systemd/clownfisch.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=🐠 Clownfischserver Telegram Bot
+Documentation=https://github.com/mehlzoerwer-claude/clownfischserver
+After=network-online.target ollama.service
+Wants=network-online.target ollama.service
+
+[Service]
+Type=simple
+User=clownfish
+Group=clownfish
+WorkingDirectory=/opt/clownfischserver
+EnvironmentFile=/opt/clownfischserver/config/.env
+ExecStart=/opt/clownfischserver/venv/bin/python3 /opt/clownfischserver/bot/bot.py
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=clownfisch
+
+# Security – allow sudo and iptables for SSH management
+AmbientCapabilities=CAP_NET_ADMIN CAP_SYS_ADMIN
+SecureBits=keep-caps
+PrivateTmp=yes
+
+[Install]
+WantedBy=multi-user.target