feat(kiosk): Migration 0021 – Ed25519-Auth, Status-Enum, Heartbeat, IP-Whitelist

Migration 0021_kiosk_security (eingeklinkt zwischen 0020 und 0022):
- kiosk_devices: token_hash + is_active → status enum(pending/approved/revoked)
- kiosk_devices: public_key, key_algorithm, enrollment_token_hash/expires_at
- kiosk_devices: last_heartbeat_at, client_version, offline_queue_size
- kiosk_devices: current_user_id (DSGVO), ip_whitelist (CIDR)
- companies: kiosk_require_approval, kiosk_track_current_user, kiosk_heartbeat_interval_sec

Model KioskDevice: komplett überarbeitet (KioskDeviceStatus Enum)
Model Company: 3 neue Kiosk-Felder

Bestehende Geräte: status=revoked (müssen neu enrolled werden)
Existing servers: SQL manuell angewendet (Alembic skip bei inserted migrations)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/models/company.py

@@ -44,6 +44,11 @@ class Company(Base):
     busylight_pull_token_hash: Mapped[str | None] = mapped_column(String(64), unique=True)
     busylight_token_created_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
 
+    # Kiosk-Konfiguration
+    kiosk_require_approval: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    kiosk_track_current_user: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    kiosk_heartbeat_interval_sec: Mapped[int] = mapped_column(Integer, nullable=False, default=30)
+
     # Relationships
     users: Mapped[list["User"]] = relationship("User", back_populates="company", lazy="noload")
     departments: Mapped[list["Department"]] = relationship("Department", back_populates="company", lazy="noload")