security: 9 Findings aus Security-Audit behoben (CRITICAL + HIGH + MEDIUM)

CRITICAL:
- C-1: LDAP tls_verify Default False → True (MITM-Schutz)
- C-2: TOTP-Secret Fernet-verschlüsselt in DB (statt Plaintext)
  - core/crypto.py: encrypt_value() / decrypt_value() helper
  - Migration 0026: totp_secret VARCHAR(64→500), ldap tls_verify default=true
  - _totp_plain() helper mit Legacy-Fallback für bestehende Werte

HIGH:
- H-1: Kiosk Nonce-Cache asyncio.Lock (Race Condition behoben)
- H-2: File-Upload-Limit 10 MB (import_kimai.py + users.py CSV-Import)
- H-3: CORS allow_methods/allow_headers explizit eingeschränkt (war *)
- H-4: TrustedHostMiddleware aktiviert wenn ALLOWED_HOSTS gesetzt

MEDIUM:
- M-1: IP-Logging nutzt X-Forwarded-For hinter nginx-Proxy
- M-4: Audit-Log für password_changed, totp_enabled, totp_disabled
- M-5: CalDAV verify_ssl in Production erzwungen (_effective_verify_ssl)

152/152 Tests grün

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/caldav_service.py

@@ -209,12 +209,27 @@ def _event_url(calendar_url: str, uid: str) -> str:
     return calendar_url.rstrip("/") + f"/{uid}.ics"
 
 
+def _effective_verify_ssl(verify_ssl: bool) -> bool:
+    """
+    Gibt den tatsächlich zu verwendenden verify_ssl-Wert zurück.
+    In Production ist SSL-Verifikation immer aktiviert – verify_ssl=False wird ignoriert.
+    """
+    if settings.is_production and not verify_ssl:
+        log.warning(
+            "CalDAV: verify_ssl=False in Production ignoriert – SSL-Verifikation wird erzwungen. "
+            "Für selbstsignierte Zertifikate das CA-Bundle unter REQUESTS_CA_BUNDLE konfigurieren."
+        )
+        return True
+    return verify_ssl
+
+
 async def _http_put(
     calendar_url: str, username: str, password: str, uid: str,
     ical: bytes, verify_ssl: bool,
 ) -> str:
     """PUT event. Returns ETag (empty string if server doesn't send one)."""
     _validate_caldav_url(calendar_url)
+    verify_ssl = _effective_verify_ssl(verify_ssl)
     url = _event_url(calendar_url, uid)
     async with httpx.AsyncClient(verify=verify_ssl, timeout=15) as client:
         resp = await client.put(
@@ -230,6 +245,7 @@ async def _http_delete(
     calendar_url: str, username: str, password: str, uid: str, verify_ssl: bool,
 ) -> None:
     _validate_caldav_url(calendar_url)
+    verify_ssl = _effective_verify_ssl(verify_ssl)
     url = _event_url(calendar_url, uid)
     async with httpx.AsyncClient(verify=verify_ssl, timeout=15) as client:
         resp = await client.delete(url, auth=(username, password))
@@ -242,6 +258,7 @@ async def _http_propfind(
 ) -> int:
     """Einfacher Verbindungstest via PROPFIND Depth:0. Gibt HTTP-Status zurück."""
     _validate_caldav_url(calendar_url)
+    verify_ssl = _effective_verify_ssl(verify_ssl)
     body = b'<?xml version="1.0"?><d:propfind xmlns:d="DAV:"><d:prop><d:resourcetype/></d:prop></d:propfind>'
     async with httpx.AsyncClient(verify=verify_ssl, timeout=10) as client:
         resp = await client.request(