Multi-Agent-Review: Race Conditions, DB-Indizes, TLS/Security-Härtung

Konsolidierte Funde aus postgres-/sql-/jwt-/owasp-top10-expert-Review:

- Race Conditions gefixt: doppelte aktive Kontrolle (SAVEPOINT + partieller
  Unique-Index), doppelte Mindermengen-Genehmigung (FOR UPDATE + Unique-Index),
  Lost-Update bei Nachfüllung (FOR UPDATE auf Fehlbestand/Objektposition).
- Migration 0007: partielle Unique-Indizes als DB-Sicherheitsnetz + fehlende
  FK-Indizes (fehlbestand.material_id, kontrolle(objekt_id,status),
  zustaendigkeit, benutzer_rolle.rolle, objektposition.ablaufdatum u.a.).
- Connection-Pool explizit begrenzt (pool_size=5, max_overflow=5) - ohne das
  könnte jeder uvicorn-Worker den Postgres max_connections-Wert sprengen.
- Timing-Angriff bei Login-Enumeration gefixt (konstante Antwortzeit über
  Dummy-Hash), JWT-Decode verlangt jetzt exp/sub-Claims.
- App-seitiges Rate-Limiting (slowapi, 5/min) auf /auth/login als Verteidigung
  in der Tiefe zusätzlich zum nginx-Limit.
- nginx: TLS mit selbstsigniertem Zertifikat (LAN-Betrieb, keine Domain),
  HSTS, Content-Security-Policy, Permissions-Policy ergänzt.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVgbozhYmuEhiEJHffRXCV

DEVLOG.md

@@ -2799,3 +2799,155 @@ Keine Commits in dieser Session.
 - flutter_app/pubspec.yaml                     |   3 +
 
 ---
+## 2026-09-04 18:38 – 18:38 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** flutter_app
+
+### Commits
+- 0909dac Flutter-Tests: ApiClient, Offline-Queue, Login-/Objektliste-Widgets
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:38 – 18:38 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** flutter_app
+
+### Commits
+- 0909dac Flutter-Tests: ApiClient, Offline-Queue, Login-/Objektliste-Widgets
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:39 – 18:39 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** asb-material
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:39 – 18:39 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** asb-material
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:39 – 18:39 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** asb-material
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:40 – 18:40 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** asb-material
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:40 – 18:40 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** asb-material
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---
+## 2026-09-04 18:40 – 18:40 (0m)
+**Beschreibung:** Claude Code Session
+**Projekt:** asb-material
+
+### Commits
+Keine Commits in dieser Session.
+
+### Geänderte Dateien
+- DEVLOG.md                                          | 16 ++++
+- flutter_app/DEVLOG.md                              | 16 ++++
+- flutter_app/README.md                              | 14 +++-
+- flutter_app/lib/api/api_client.dart                | 15 ++--
+- flutter_app/pubspec.yaml                           |  2 +
+- flutter_app/test/api_client_test.dart              | 90 ++++++++++++++++++++
+- flutter_app/test/offline_queue_test.dart           | 96 ++++++++++++++++++++++
+- flutter_app/test/widget/login_screen_test.dart     | 57 +++++++++++++
+- .../test/widget/objekt_list_screen_test.dart       | 51 ++++++++++++
+
+---