Security: WS-Rollenprüfung, JWT-Cookie statt localStorage, XSS/SSRF-Fixes, RDP-Consent-Secret

- WebSocket Shell/RDP: Rollenprüfung statt nur JWT-Gültigkeit (war: jeder eingeloggte User konnte fremde Agents per Shell/RDP übernehmen)
- JWT_SECRET: Server bricht ab statt mit unsicherem Default weiterzulaufen
- Auth: Token läuft jetzt über httpOnly-Cookie statt localStorage (XSS-Schutz gegen Session-Diebstahl)
- WS-Auth: Token nicht mehr als URL-Query-Param (landete in nginx-Logs), sondern als erste Message bzw. automatisch via Cookie
- Frontend: toter Rollen-Check (isSuperAdmin/isAdmin ohne Funktionsaufruf) in AgentDetailPage gefixt
- XSS: DOMPurify-Sanitizing für alle marked.parse()-Renderstellen (KI-Antworten, Kommentare, Knowledge Base)
- E-Mail: HTML-Escaping für alle ticket-gesteuerten Felder (auch über öffentliche Ticket-Route erreichbar)
- SSRF-Schutz beim Knowledge-Base-URL-Import (blockt private/Loopback-Adressen)
- TV-Dashboard: Shared-Key statt komplett offenem Endpoint
- Striktes Rate-Limit auf /login, must_change_password serverseitig erzwungen
- Agent (C#) v2.7.0: RDP-Consent/Disconnect/Capture verlangen jetzt ein Pro-Session-Secret (war: jeder lokale Prozess konnte Consent vortäuschen), DataDir-ACL für agent.log/status.json
- FIDO-PINs AES-256-GCM-verschlüsselt statt Klartext, Retention-Job für alte patch_commands/audit_log

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/public/share-tool.html

@@ -1234,21 +1234,16 @@ button, input, textarea, select { font: inherit; color: inherit; }
   let shares = [];
   let demoMode = false;
 
-  /* ---------- Auth token ---------- */
-  const TOKEN_KEY = "token";
-  const getToken = () => localStorage.getItem(TOKEN_KEY);
-  const setToken = (t) => localStorage.setItem(TOKEN_KEY, t);
-  const clearToken = () => localStorage.removeItem(TOKEN_KEY);
+  /* ---------- Auth (httpOnly-Cookie, kein Token in localStorage/URL) ---------- */
+  let demoModeFlag = false;
 
   /* ---------- Fetch helper ---------- */
   async function api(path, opts = {}) {
     const headers = new Headers(opts.headers || {});
-    const tk = getToken();
-    if (tk) headers.set("Authorization", "Bearer " + tk);
     if (opts.body && !(opts.body instanceof FormData) && !headers.has("Content-Type")) {
       headers.set("Content-Type", "application/json");
     }
-    const res = await fetch(path, { ...opts, headers });
+    const res = await fetch(path, { ...opts, headers, credentials: "include" });
     if (!res.ok) {
       const err = new Error("HTTP " + res.status);
       err.status = res.status;
@@ -1259,19 +1254,6 @@ button, input, textarea, select { font: inherit; color: inherit; }
     return ct.includes("application/json") ? res.json() : res.text();
   }
 
-  /* ---------- Capture ?token= from URL ---------- */
-  function captureUrlToken() {
-    const params = new URLSearchParams(location.search);
-    const t = params.get("token");
-    if (t) {
-      setToken(t);
-      params.delete("token");
-      const qs = params.toString();
-      const newUrl = location.pathname + (qs ? "?" + qs : "") + location.hash;
-      history.replaceState(null, "", newUrl);
-    }
-  }
-
   /* ---------- Theme toggle ---------- */
   (function initTheme() {
     const KEY = "cereda-theme";
@@ -1290,17 +1272,12 @@ button, input, textarea, select { font: inherit; color: inherit; }
 
   /* ---------- Init ---------- */
   async function init() {
-    captureUrlToken();
-    const tk = getToken();
-    if (!tk) return showLogin();
-
     try {
       const me = await api("/api/auth/me");
       showApp(me);
       await loadShares();
     } catch (e) {
       if (e.status === 401 || e.status === 403) {
-        clearToken();
         showLogin();
       } else {
         enterDemoMode();
@@ -1311,7 +1288,7 @@ button, input, textarea, select { font: inherit; color: inherit; }
   /* ---------- Demo fallback ---------- */
   function enterDemoMode() {
     demoMode = true;
-    setToken("demo-token");
+    demoModeFlag = true;
     showApp({ username: "m.schmidt", display_name: "Marco Schmidt" });
     demoBadge.classList.add("on");
     shares = seedShares();
@@ -1391,12 +1368,11 @@ button, input, textarea, select { font: inherit; color: inherit; }
         method: "POST",
         body: JSON.stringify({ username, password })
       });
-      if (res && res.token) {
-        setToken(res.token);
+      if (res && res.status === "success") {
         const me = await api("/api/auth/me").catch(() => null);
         showApp(me || { username });
         await loadShares();
-      } else throw new Error("No token in response.");
+      } else throw new Error("Login fehlgeschlagen.");
     } catch (err) {
       if (err.status === 401 || err.status === 403) {
         // Real auth rejection — show the error
@@ -1413,7 +1389,7 @@ button, input, textarea, select { font: inherit; color: inherit; }
 
   /* ---------- Logout ---------- */
   logoutBtn.addEventListener("click", () => {
-    clearToken();
+    if (!demoModeFlag) { api("/api/auth/logout", { method: "POST" }).catch(() => {}); }
     shares = [];
     pickedFile = null;
     demoMode = false;
@@ -1593,7 +1569,7 @@ button, input, textarea, select { font: inherit; color: inherit; }
       const list = await api("/api/shares");
       shares = Array.isArray(list) ? list : (list?.shares || []);
     } catch (e) {
-      if (e.status === 401) { clearToken(); showLogin(); return; }
+      if (e.status === 401) { showLogin(); return; }
       // 403 = not admin, just show empty list — user can still create shares
       shares = [];
     }