Referrals: 4 neue Beziehungen + Bearbeiten-Stift pro Eintrag

Beziehungs-Dropdown erweitert um Schwiegertochter/Schwiegersohn,
Schwiegermutter/Schwiegervater, Oma/Opa, Uroma/Uropa (Whitelist
front- und backend synchron).

Bearbeiten-Stift pro Zeile (vor der Muelltonne): Beziehung und/oder
Gegen-Kunde aenderbar. Neuer PUT /:customerId/referrals/:referralId
mit Whitelist-Pruefung, Doppel-Werber-409 (Self-Ausschluss),
Portal-Block und UPDATE-Auditeintrag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/controllers/customerReferral.controller.ts

@@ -106,6 +106,61 @@ export async function createReferral(req: AuthRequest, res: Response): Promise<v
   }
 }
 
+export async function updateReferral(req: AuthRequest, res: Response): Promise<void> {
+  try {
+    if (blockPortal(req, res)) return;
+    const customerId = parseInt(req.params.customerId);
+    const referralId = parseInt(req.params.referralId);
+    if (Number.isNaN(customerId) || Number.isNaN(referralId)) {
+      res.status(400).json({ success: false, error: 'Ungültige ID' } as ApiResponse);
+      return;
+    }
+    const { direction, otherCustomerId, relationship } = req.body ?? {};
+    const otherId = parseInt(otherCustomerId);
+    if (Number.isNaN(otherId)) {
+      res.status(400).json({ success: false, error: 'Kein Kunde ausgewählt' } as ApiResponse);
+      return;
+    }
+
+    let recruiterId: number;
+    let recruitedId: number;
+    if (direction === 'recruitedBy') {
+      recruiterId = otherId;
+      recruitedId = customerId;
+    } else if (direction === 'recruited') {
+      recruiterId = customerId;
+      recruitedId = otherId;
+    } else {
+      res.status(400).json({ success: false, error: 'Ungültige Richtung' } as ApiResponse);
+      return;
+    }
+
+    const updated = await referralService.updateReferral({
+      id: referralId,
+      recruiterId,
+      recruitedId,
+      relationship: (relationship ?? '').toString(),
+    });
+
+    await logChange({
+      req,
+      action: 'UPDATE',
+      resourceType: 'CustomerReferral',
+      resourceId: updated.id.toString(),
+      label: `Werbe-Beziehung geändert: Kunde #${recruiterId} hat Kunde #${recruitedId} geworben (${updated.relationship})`,
+      customerId: recruitedId,
+    });
+
+    res.json({ success: true, data: updated } as ApiResponse);
+  } catch (error) {
+    const status = (error as referralService.ReferralError)?.status ?? 500;
+    res.status(status).json({
+      success: false,
+      error: error instanceof Error ? error.message : 'Fehler beim Ändern der Werbe-Beziehung',
+    } as ApiResponse);
+  }
+}
+
 export async function deleteReferral(req: AuthRequest, res: Response): Promise<void> {
   try {
     if (blockPortal(req, res)) return;