Login-Sicherheit: Account-Lockout, konfigurierbar, Admin-Verwaltung, .env für JWT-Secret

backend/src/db.js

@@ -246,6 +246,39 @@ if (msgCols2.length && !msgCols2.includes('read_by_recipient')) {
   db.exec("ALTER TABLE messages ADD COLUMN read_by_recipient INTEGER NOT NULL DEFAULT 0");
 }
 
+// ── Login-Sicherheit ──────────────────────────────────────────────────────────
+// Spalten für Account-Lockout in users-Tabelle
+const userCols = db.prepare("PRAGMA table_info(users)").all().map(r => r.name);
+if (!userCols.includes('failed_attempts'))
+  db.exec("ALTER TABLE users ADD COLUMN failed_attempts INTEGER NOT NULL DEFAULT 0");
+if (!userCols.includes('locked_until'))
+  db.exec("ALTER TABLE users ADD COLUMN locked_until DATETIME DEFAULT NULL");
+if (!userCols.includes('last_failed_at'))
+  db.exec("ALTER TABLE users ADD COLUMN last_failed_at DATETIME DEFAULT NULL");
+
+// Login-Fehlversuche Log
+if (!db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='login_attempts'").get()) {
+  db.exec(`
+    CREATE TABLE login_attempts (
+      id         INTEGER PRIMARY KEY AUTOINCREMENT,
+      username   TEXT NOT NULL,
+      ip         TEXT,
+      success    INTEGER NOT NULL DEFAULT 0,
+      created_at DATETIME DEFAULT NULL
+    )
+  `);
+}
+
+// Default-Einstellungen für Login-Schutz
+const loginDefaults = [
+  ['login_max_attempts', '5'],
+  ['login_lockout_minutes', '30'],
+];
+for (const [k, v] of loginDefaults) {
+  if (!db.prepare('SELECT value FROM admin_settings WHERE key=?').get(k))
+    db.prepare('INSERT INTO admin_settings (key, value) VALUES (?, ?)').run(k, v);
+}
+
 // ── Kalkulator-Shares ─────────────────────────────────────────────────────────
 if (!db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='calculation_shares'").get()) {
   db.exec(`