security: M-2 HttpOnly-Cookie + M-4 TrustedHost-Warning + M-5 TOTP-Lockout + M-7 zentraler get_client_ip()

M-2: Refresh-Token als HttpOnly SameSite=Strict Cookie
- auth.py: _set_refresh_cookie/_delete_refresh_cookie Helpers
- Alle Auth-Endpoints (login, totp/login, refresh, logout) nutzen Cookie
- schemas/auth.py: refresh_token in Request/Response optional
- AuthContext.tsx: kein refresh_token in localStorage
- api/client.ts: credentials:include, kein Token-Body beim Refresh

M-4: TrustedHostMiddleware Warning in Production
- main.py: Startup-Warning wenn is_production + kein ALLOWED_HOSTS

M-5: TOTP-Fehlversuche Redis-Lockout
- auth.py: _check/_record/_clear_totp_lockout; 5 Versuche → 15 min Sperre

M-7: Zentraler get_client_ip()-Helper
- core/dependencies.py: get_client_ip() mit X-Real-IP → X-Forwarded-For → client.host
- hours_payouts.py, absences.py, busylight.py: request.client.host ersetzt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/busylight.py

@@ -15,7 +15,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.database import get_db
-from app.core.dependencies import require_role
+from app.core.dependencies import get_client_ip, require_role
 from app.core.limiter import limiter
 from app.models.absence import Absence, AbsenceStatus
 from app.models.absence_type import AbsenceType
@@ -71,7 +71,7 @@ async def rotate_busylight_token(
         action="busylight_token_rotated",
         entity_type="company",
         entity_id=company.id,
-        ip=request.client.host if request.client else None,
+        ip=get_client_ip(request),
     ))
     await db.commit()
     return BusylightTokenRotated(token=token, created_at=company.busylight_token_created_at)
@@ -95,7 +95,7 @@ async def delete_busylight_token(
         action="busylight_token_revoked",
         entity_type="company",
         entity_id=company.id,
-        ip=request.client.host if request.client else None,
+        ip=get_client_ip(request),
     ))
     await db.commit()