feat: auth system (middleware + login) + remove .env from git + fix hardcoded token

CRITICAL SECURITY FIXES:
- src/middleware.ts: protects all routes except public ones (health, license check, seed-prod)
  Redirects unauthenticated users to /login, returns 401 for API routes
- src/app/login/page.tsx: login page with password input
- src/app/api/auth/login: HMAC-signed session cookie (7-day expiry)
- src/app/api/auth/logout: clears session cookie
- Top bar: Abmelden (logout) button now functional
- .env removed from git tracking (secrets no longer in repo)
- seed-prod: hardcoded admin token replaced with env MCP_API_TOKEN or random UUID
- ADMIN_PASSWORD env var required for login (set in Dokploy env)

Public routes (no auth needed):
  /api/health, /api/aos/seed-prod, /api/aos/licenses/check, /api/aos/licenses/validate
  /api/v1/* (token-auth'd), /api/mcp (token-auth'd), /login

src/app/login/page.tsx

@@ -0,0 +1,84 @@
+'use client'
+
+import { useState } from 'react'
+import { useRouter, useSearchParams } from 'next/navigation'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+import { Loader2, Lock } from 'lucide-react'
+
+export default function LoginPage() {
+  const router = useRouter()
+  const searchParams = useSearchParams()
+  const redirect = searchParams.get('redirect') || '/'
+  const [password, setPassword] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [error, setError] = useState('')
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    if (!password) return
+    setLoading(true)
+    setError('')
+    try {
+      const res = await fetch('/api/auth/login', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ password, redirect }),
+      })
+      const data = await res.json()
+      if (!res.ok) {
+        setError(data.error || 'Login fehlgeschlagen')
+        return
+      }
+      router.push(data.redirect || '/')
+      router.refresh()
+    } catch {
+      setError('Netzwerkfehler')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-background p-4">
+      <div className="w-full max-w-sm space-y-6">
+        <div className="text-center space-y-2">
+          <div className="mx-auto flex size-14 items-center justify-center rounded-xl bg-foreground text-background">
+            <Lock className="size-7" />
+          </div>
+          <h1 className="text-2xl font-semibold tracking-tight">AOS Login</h1>
+          <p className="text-sm text-muted-foreground">
+            Agency Operating System — dfmpanel.eu
+          </p>
+        </div>
+
+        <form onSubmit={handleSubmit} className="space-y-4">
+          <div className="space-y-2">
+            <Label htmlFor="password">Passwort</Label>
+            <Input
+              id="password"
+              type="password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              placeholder="Admin-Passwort eingeben"
+              autoFocus
+              autoComplete="current-password"
+            />
+          </div>
+          {error && (
+            <p className="text-sm text-red-600 dark:text-red-400">{error}</p>
+          )}
+          <Button type="submit" className="w-full gap-2" disabled={loading || !password}>
+            {loading && <Loader2 className="size-4 animate-spin" />}
+            Anmelden
+          </Button>
+        </form>
+
+        <p className="text-center text-xs text-muted-foreground">
+          Geschützter Bereich — nur für autorisierte Benutzer.
+        </p>
+      </div>
+    </div>
+  )
+}