feat: auth system (middleware + login) + remove .env from git + fix hardcoded token

CRITICAL SECURITY FIXES:
- src/middleware.ts: protects all routes except public ones (health, license check, seed-prod)
  Redirects unauthenticated users to /login, returns 401 for API routes
- src/app/login/page.tsx: login page with password input
- src/app/api/auth/login: HMAC-signed session cookie (7-day expiry)
- src/app/api/auth/logout: clears session cookie
- Top bar: Abmelden (logout) button now functional
- .env removed from git tracking (secrets no longer in repo)
- seed-prod: hardcoded admin token replaced with env MCP_API_TOKEN or random UUID
- ADMIN_PASSWORD env var required for login (set in Dokploy env)

Public routes (no auth needed):
  /api/health, /api/aos/seed-prod, /api/aos/licenses/check, /api/aos/licenses/validate
  /api/v1/* (token-auth'd), /api/mcp (token-auth'd), /login

src/components/aos/top-bar.tsx

@@ -110,7 +110,16 @@ export function TopBar() {
             <DropdownMenuItem>Profil</DropdownMenuItem>
             <DropdownMenuItem>Sitzungen</DropdownMenuItem>
             <DropdownMenuSeparator />
-            <DropdownMenuItem className="text-muted-foreground">Abmelden</DropdownMenuItem>
+            <DropdownMenuItem
+              className="text-muted-foreground"
+              onSelect={async (e) => {
+                e.preventDefault()
+                await fetch('/api/auth/logout', { method: 'POST' })
+                window.location.href = '/login'
+              }}
+            >
+              Abmelden
+            </DropdownMenuItem>
           </DropdownMenuContent>
         </DropdownMenu>
       </div>