feat: questions table with trilingual sentences

- status enum (draft/blocked/published), auto-timestamps
- sentence_de/en/se, blocked_topic
- Safe ALTER TABLE migration for existing placeholder
- /api/questions CRUD route

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/db-migrate.js

@@ -116,15 +116,32 @@ async function migrate() {
     )
   `);
 
-  // questions placeholder (Felder folgen später)
   await query(`
     CREATE TABLE IF NOT EXISTS questions (
-      id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      id            UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+      status        VARCHAR(20) NOT NULL DEFAULT 'draft'
+                      CHECK (status IN ('draft', 'blocked', 'published')),
+      sentence_de   TEXT,
+      sentence_en   TEXT,
+      sentence_se   TEXT,
+      blocked_topic TEXT,
+      published_at  TIMESTAMPTZ,
+      blocked_at    TIMESTAMPTZ,
+      created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
     )
   `);
 
+  const questionCols = [
+    "status VARCHAR(20) NOT NULL DEFAULT 'draft'",
+    'sentence_de TEXT', 'sentence_en TEXT', 'sentence_se TEXT',
+    'blocked_topic TEXT', 'published_at TIMESTAMPTZ', 'blocked_at TIMESTAMPTZ',
+  ];
+  for (const col of questionCols)
+    await query(`ALTER TABLE questions ADD COLUMN IF NOT EXISTS ${col}`).catch(() => {});
+  await query(`ALTER TABLE questions DROP CONSTRAINT IF EXISTS questions_status_check`).catch(() => {});
+  await query(`ALTER TABLE questions ADD CONSTRAINT questions_status_check CHECK (status IN ('draft', 'blocked', 'published'))`).catch(() => {});
+
   await query(`
     DROP TRIGGER IF EXISTS questions_updated_at ON questions;
     CREATE TRIGGER questions_updated_at

src/index.js

@@ -29,6 +29,7 @@ app.use('/api/words', auth, require('./routes/words'));
 app.use('/api/categories', auth, require('./routes/categories'));
 app.use('/api/objects', auth, require('./routes/objects'));
 app.use('/api/pairs', auth, require('./routes/pairs'));
+app.use('/api/questions', auth, require('./routes/questions'));
 
 // 404
 app.use((req, res) => {

src/routes/questions.js

@@ -0,0 +1,81 @@
+const router = require('express').Router();
+const { query } = require('../db');
+
+const STATUSES = ['draft', 'blocked', 'published'];
+const STATUS_TIMESTAMP = { published: 'published_at', blocked: 'blocked_at' };
+
+// GET /api/questions
+router.get('/', async (req, res, next) => {
+  try {
+    const { status, limit = 50, offset = 0 } = req.query;
+    const params = [Math.min(parseInt(limit), 500), parseInt(offset)];
+    const where = status ? `WHERE status = $3` : '';
+    if (status) params.push(status);
+    const result = await query(
+      `SELECT * FROM questions ${where} ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
+      params
+    );
+    res.json(result.rows);
+  } catch (err) { next(err); }
+});
+
+// GET /api/questions/:id
+router.get('/:id', async (req, res, next) => {
+  try {
+    const result = await query('SELECT * FROM questions WHERE id = $1', [req.params.id]);
+    if (!result.rows.length) return res.status(404).json({ error: 'Not found' });
+    res.json(result.rows[0]);
+  } catch (err) { next(err); }
+});
+
+// POST /api/questions
+router.post('/', async (req, res, next) => {
+  try {
+    const { sentence_de, sentence_en, sentence_se, blocked_topic } = req.body;
+    const result = await query(
+      `INSERT INTO questions (sentence_de, sentence_en, sentence_se, blocked_topic)
+       VALUES ($1, $2, $3, $4) RETURNING *`,
+      [sentence_de || null, sentence_en || null, sentence_se || null, blocked_topic || null]
+    );
+    res.status(201).json(result.rows[0]);
+  } catch (err) { next(err); }
+});
+
+// PATCH /api/questions/:id
+router.patch('/:id', async (req, res, next) => {
+  try {
+    const allowed = ['status', 'sentence_de', 'sentence_en', 'sentence_se',
+                     'blocked_topic', 'published_at', 'blocked_at'];
+    const fields = Object.keys(req.body).filter(k => allowed.includes(k));
+    if (!fields.length) return res.status(400).json({ error: 'No valid fields provided' });
+
+    if (req.body.status && !STATUSES.includes(req.body.status))
+      return res.status(400).json({ error: `status must be one of: ${STATUSES.join(', ')}` });
+
+    const tsField = STATUS_TIMESTAMP[req.body.status];
+    if (tsField && !req.body[tsField]) {
+      fields.push(tsField);
+      req.body[tsField] = new Date().toISOString();
+    }
+
+    const setClauses = fields.map((f, i) => `${f} = $${i + 1}`).join(', ');
+    const values = [...fields.map(f => req.body[f]), req.params.id];
+    const result = await query(
+      `UPDATE questions SET ${setClauses} WHERE id = $${fields.length + 1} RETURNING *`,
+      values
+    );
+    if (!result.rows.length) return res.status(404).json({ error: 'Not found' });
+    res.json(result.rows[0]);
+  } catch (err) { next(err); }
+});
+
+// DELETE /api/questions/:id
+router.delete('/:id', async (req, res, next) => {
+  try {
+    const result = await query('DELETE FROM questions WHERE id = $1 RETURNING id', [req.params.id]);
+    if (!result.rows.length) return res.status(404).json({ error: 'Not found' });
+    res.status(204).end();
+  } catch (err) { next(err); }
+});
+
+module.exports = router;