docs(settings): Update README + Copilot instructions; bump Program Info to 2025.1.0-alpha.11

README: Add System Settings API endpoints; describe new tabbed Settings layout with role gating; add Vite dev proxy tip to use relative /api paths.
Copilot instructions: Note SystemSetting key–value store in data model; document system_settings.py (CRUD + supplement-table convenience endpoint); reference apiSystemSettings.ts; note defaults seeding via init_defaults.py.
Program Info: Bump version to 2025.1.0-alpha.11; changelog explicitly tied to the Settings page (Events tab: supplement-table URL moved; Academic Calendar: set active period; proxy note); README docs mention.
No functional changes to API or UI code in this commit; documentation and program info only.

.github/copilot-instructions.md

@@ -38,6 +38,7 @@ Use this as your shared context when proposing changes. Keep edits minimal and m
 ## Data model highlights (see `models/models.py`)
 - Enums: `EventType` (presentation, website, video, message, webuntis), `MediaType` (file/website types), and `AcademicPeriodType` (schuljahr, semester, trimester).
 - Tables: `clients`, `client_groups`, `events`, `event_media`, `users`, `academic_periods`, `school_holidays`.
+- System settings: `system_settings` key–value store via `SystemSetting` for global configuration (e.g., WebUntis/Vertretungsplan supplement-table). Managed through routes in `server/routes/system_settings.py`.
 - Academic periods: `academic_periods` table supports educational institution cycles (school years, semesters). Events and media can be optionally linked via `academic_period_id` (nullable for backward compatibility).
 - Times are stored as timezone-aware; treat comparisons in UTC (see scheduler and routes/events).
 
@@ -54,6 +55,7 @@ Use this as your shared context when proposing changes. Keep edits minimal and m
   - Groups: `server/routes/groups.py` computes “alive” using a grace period that varies by `ENV`.
   - Events: `server/routes/events.py` serializes enum values to strings and normalizes times to UTC.
   - Media: `server/routes/eventmedia.py` implements a simple file manager API rooted at `server/media/`.
+  - System settings: `server/routes/system_settings.py` exposes key–value CRUD (`/api/system-settings`) and a convenience endpoint for WebUntis/Vertretungsplan supplement-table: `GET/POST /api/system-settings/supplement-table` (admin+).
   - Academic periods: `server/routes/academic_periods.py` exposes:
     - `GET /api/academic_periods` — list all periods
     - `GET /api/academic_periods/active` — currently active period
@@ -94,6 +96,25 @@ Use this as your shared context when proposing changes. Keep edits minimal and m
   - Implemented with Syncfusion DropDownButton (`@syncfusion/ej2-react-splitbuttons`).
   - “Abmelden” navigates to `/logout`; the page invokes backend logout and redirects to `/login`.
 
+- Settings page (`dashboard/src/settings.tsx`):
+  - Structure: Syncfusion TabComponent with role-gated tabs
+    - 📅 Academic Calendar (all users)
+      - School Holidays: CSV/TXT import and list
+      - Academic Periods: select and set active period (uses `/api/academic_periods` routes)
+    - 🖥️ Display & Clients (admin+)
+      - Default Settings: placeholders for heartbeat, screenshots, defaults
+      - Client Configuration: quick links to Clients and Groups pages
+    - 🎬 Media & Files (admin+)
+      - Upload Settings: placeholders for limits and types
+      - Conversion Status: placeholder for conversions overview
+    - 🗓️ Events (admin+)
+      - WebUntis / Vertretungsplan: system-wide supplement table URL with enable/disable, save, and preview; persists via `/api/system-settings/supplement-table`
+      - Other event types (presentation, website, video, message, other): placeholders for defaults
+    - ⚙️ System (superadmin)
+      - Organization Info and Advanced Configuration placeholders
+  - Role gating: Admin/Superadmin tabs are hidden if the user lacks permission; System is superadmin-only
+  - API clients use relative `/api/...` URLs so Vite dev proxy handles requests without CORS issues. The settings UI calls are centralized in `dashboard/src/apiSystemSettings.ts`.
+
 - User dropdown technical notes:
   - Dependencies: `@syncfusion/ej2-react-splitbuttons` and `@syncfusion/ej2-splitbuttons` must be installed.
   - Vite: add both to `optimizeDeps.include` in `vite.config.ts` to avoid import-analysis errors.
@@ -109,6 +130,7 @@ Note: Syncfusion usage in the dashboard is already documented above; if a UI for
 - Common env vars: `DB_CONN`, `DB_USER`, `DB_PASSWORD`, `DB_HOST=db`, `DB_NAME`, `ENV`, `MQTT_USER`, `MQTT_PASSWORD`.
   - Alembic: prod compose runs `alembic ... upgrade head` and `server/init_defaults.py` before gunicorn.
   - Local dev: prefer `python server/initialize_database.py` for one-shot setup (migrations + defaults + academic periods).
+  - Defaults: `server/init_defaults.py` seeds initial system settings like `supplement_table_url` and `supplement_table_enabled` if missing.
   - `server/init_academic_periods.py` remains available to (re)seed school years.
 
 ## Production