refactor: update ADMIN_USER_CODES configuration; move to auth_api and clarify usage in documentation

GETTING_STARTED.md

@@ -24,7 +24,7 @@ POSTGRES_PASSWORD_AUTH=your_password
 POSTGRES_USER_TRANSIT=transitAPI
 POSTGRES_PASSWORD_TRANSIT=your_password
 JWT_SECRET=your-secure-secret
-ADMIN_USER_CODES=42
+# ADMIN_USER_CODES should be set in auth_api/.env (comma-separated admin user codes)
 ```
 
 ### Step 3: Start Services

README.md

@@ -370,10 +370,11 @@ Admin dashboard uses simple JWT-based authentication:
 2. Receive JWT token from `auth_api`
 3. Use token for admin operations (`/admin/*` endpoints)
 
-Admin authorization is controlled by `ADMIN_USER_CODES` environment variable:
+Admin authorization is controlled by `ADMIN_USER_CODES` environment variable configured in the `auth_api` service:
 
 ```bash
-ADMIN_USER_CODES=42,101,205  # Comma-separated admin user codes
+# Set admin user codes for the auth service (comma-separated)
+ADMIN_USER_CODES=42,101,205
 ```
 
 ---
@@ -385,7 +386,8 @@ ADMIN_USER_CODES=42,101,205  # Comma-separated admin user codes
 Use `DEV_MOCK=1` to work without a database (in-memory mock storage):
 
 ```bash
-ADMIN_USER_CODES=42 DEV_MOCK=1 JWT_SECRET=devsecret npm --prefix ./transit_api start
+# For local development set admin codes on the auth_api and start services
+ADMIN_USER_CODES=42 DEV_MOCK=1 JWT_SECRET=devsecret npm --prefix ./auth_api start
 ```
 
 ### Production Mode

admin_ui/README.md

@@ -134,7 +134,7 @@ All requests include JWT Bearer token for authentication.
 
 ### Admin Authorization
 
-Users must have a `userCode` in their JWT that matches `ADMIN_USER_CODES` environment variable in the transit API to access admin endpoints.
+Users must have a `userCode` in their JWT and, for admin access, the `isAdmin` flag set by the `auth_api` based on the `ADMIN_USER_CODES` environment variable.
 
 ### Production Setup
 

transit_api/README.md

@@ -42,10 +42,11 @@ PG_USER=your_user
 PG_PASS=your_password
 PG_DB=your_database
 JWT_SECRET=your_jwt_secret
-ADMIN_USER_CODES=12345,67890
 PORT=5001
 ```
 
+Note: `ADMIN_USER_CODES` has been moved to the `auth_api` service. Configure admin user codes in `auth_api/.env` as a comma-separated list.
+
 ### 4. API starten
 
 ```bash