Security + E-Mail-HTML + Quartalsbericht + Registrierungspflicht

Registrierung & Login:
- E-Mail-Verifikation jetzt Pflicht vor erstem Login
- Register gibt keinen Token mehr zurück → "Postfach prüfen"-Screen
- Login blockt mit EMAIL_NOT_VERIFIED (403) wenn unverifiziert
- Resend-Verification ohne Auth (email-basiert)
- Frontend: _renderVerifyPending() nach Register und Login-Fehler
- Account-Lockout: 5 Fehlversuche → 15 Min gesperrt (ratelimit.py)
- Login Rate-Limit zusätzlich per E-Mail-Adresse (5/5 Min)
- Fehler-Tracking wird bei erfolgreichem Login zurückgesetzt

E-Mail-Templates (alle Mails jetzt HTML):
- email_html() Shared-Template in mailer.py (Gradient-Header, Warm-Beige)
- Verifikations-Mail, Passwort-Reset → HTML mit CTA-Button
- Admin-Outreach: plain text auto-wrapped in HTML
- Züchter-Mails (Antrag/Genehmigung/Ablehnung) → Template
- Tierschutz-Alert (litters.py) → Template
- send_support_mail → HTML
- outreach._build_message() + _send_smtp() unterstützen jetzt html= Parameter

Forum-Schutz:
- Post-Cooldown: 30 Sek zwischen beliebigen Posts (DB-Check)
- Stunden-Limit: 5 Threads / 20 Antworten pro User/Stunde
- Duplikat-Erkennung: gleicher Text in 5 Min blockiert (in-memory)
- content_filter.py: Spam-Keywords, URL-Sperre für Accounts < 7 Tage,
  Sonderzeichen-Ratio-Check

Security-Headers:
- HSTS: max-age=31536000; includeSubDomains
- Content-Security-Policy: frame-ancestors none, base-uri self, …
- X-Frame-Options entfernt (CSP frame-ancestors ist moderner)

Honeypot-Fallen (13 Scanner-Pfade → 24h IP-Sperre):
- /api/admin/users, /api/v1/users, /api/.env, /api/config,
  /api/setup, /api/install, /api/phpinfo, /api/debug,
  /api/actuator, /api/swagger, /api/graphql u.a.

Quartalsbericht-System:
- backend/scripts/generate_reports.py: 6 Sections
  (Sicherheit, Funktionsumfang, Dateien, Nutzer, Partner, Server)
- make reports: generiert alle Berichte aus dem Container, committed
- Scheduler: quarterly_report Job (1. Feb/Mai/Aug/Nov 07:00)
  → vollständige HTML-Mail an ADMIN_EMAIL
- quarterly_report erscheint im täglichen Status-Report

Admin-Panel:
- "Forum & Meldungen" → "Forum"

backend/main.py

@@ -67,11 +67,20 @@ app = FastAPI(
 class SecurityHeadersMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
         response = await call_next(request)
-        response.headers["X-Frame-Options"]        = "SAMEORIGIN"
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Referrer-Policy"]        = "strict-origin-when-cross-origin"
-        response.headers["Permissions-Policy"]     = "camera=(), microphone=(), geolocation=(self)"
-        response.headers["X-XSS-Protection"]       = "1; mode=block"
+        response.headers["X-Content-Type-Options"]  = "nosniff"
+        response.headers["Referrer-Policy"]          = "strict-origin-when-cross-origin"
+        response.headers["Permissions-Policy"]       = "camera=(), microphone=(), geolocation=(self)"
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        response.headers["Content-Security-Policy"]  = (
+            "default-src 'self'; "
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+            "style-src 'self' 'unsafe-inline'; "
+            "img-src 'self' data: blob: https:; "
+            "connect-src 'self' https:; "
+            "frame-ancestors 'none'; "
+            "base-uri 'self'; "
+            "form-action 'self';"
+        )
         return response
 
 app.add_middleware(SecurityHeadersMiddleware)
@@ -1617,6 +1626,43 @@ async def partner_landing():
     return HTMLResponse(content=html, headers={"Cache-Control": "no-cache"})
 
 
+# ------------------------------------------------------------------
+# Honeypot-Fallen für Scanner und Bots
+# Jeder Aufruf → 24h IP-Sperre
+# ------------------------------------------------------------------
+from ratelimit import block_ip as _block_ip
+
+_HONEYPOT_PATHS = [
+    "/api/admin/users",
+    "/api/v1/users",
+    "/api/users",
+    "/api/.env",
+    "/api/config",
+    "/api/setup",
+    "/api/install",
+    "/api/phpinfo",
+    "/api/debug",
+    "/api/actuator",
+    "/api/actuator/health",
+    "/api/swagger",
+    "/api/graphql",
+]
+
+async def _honeypot_handler(request: Request):
+    import logging as _log
+    _log.getLogger("banyaro.security").warning(
+        "Honeypot getroffen: %s %s — IP %s",
+        request.method, request.url.path,
+        request.client.host if request.client else "?"
+    )
+    _block_ip(request, hours=24)
+    from fastapi.responses import JSONResponse
+    return JSONResponse(status_code=404, content={"detail": "Not Found"})
+
+for _hp in _HONEYPOT_PATHS:
+    app.add_api_route(_hp, _honeypot_handler, methods=["GET", "POST", "PUT", "DELETE"], include_in_schema=False)
+
+
 # SPA Fallback — ALLE nicht-API-Routen gehen zur index.html
 @app.get("/{full_path:path}")
 async def spa_fallback(full_path: str):