Security-Hardening Runde 10: Security-Monitoring + Alerting

Defense-in-Depth für alles, was in den ersten 9 Runden nicht durch Code
verhindert wurde: zumindest gesehen + alarmiert werden.

📊 SecurityEvent-Tabelle (Prisma)
- Type/Severity/IP/User/Endpoint + Indexen für Filter+Threshold-Detection
- Trennt sich vom AuditLog: AuditLog ist forensisch + hash-gekettet,
  SecurityEvent ist optimiert für Realtime-Alerting + Aggregation.

🪝 Hooks an kritischen Stellen
- Login (Success/Failed) – auth.controller
- Logout, Password-Reset (Request + Confirm) – auth.controller
- Rate-Limit-Hit – middleware/rateLimit
- IDOR-403 – utils/accessControl (canAccessCustomer / canAccessContract)
- SSRF-Block – emailProvider.controller (test-connection + test-mail-access)
- JWT-Reject (alg=none, expired, manipuliert) – middleware/auth

🚨 Threshold-Detection + Alerting (securityAlert.service.ts)
- Cron jede Minute: prüft Brute-Force-Patterns je IP
  - 10× LOGIN_FAILED in 60 min  → CRITICAL Brute-Force-Verdacht
  -  5× ACCESS_DENIED in 5 min  → CRITICAL IDOR-Probing-Verdacht
  -  3× SSRF_BLOCKED in 60 min  → CRITICAL SSRF-Probing
  -  3× TOKEN_REJECTED HIGH in 5 min → CRITICAL JWT-Manipulation
- CRITICAL-Events: Sofort-Alert per E-Mail (debounced)
- Cron stündlich: Digest mit HIGH+MEDIUM-Events (wenn aktiviert)
- Sofort-Alert + Digest laufen über System-E-Mail-Provider
  (gleicher Pfad wie Geburtstagsgrüße, Passwort-Reset)

🖥 Frontend: Settings → "Sicherheits-Monitoring"
- Alert-E-Mail-Adresse + Digest-Toggle
- Test-Alert-Button + Digest-jetzt-Button
- Stats-Cards pro Severity (CRITICAL/HIGH/MEDIUM/LOW/INFO)
- Filter (Type/Severity/Search/IP) + Pagination
- Auto-Refresh alle 30 s
- Verlinkt aus Settings-Übersicht (settings:read Permission)

🧪 Live-verifiziert
- Login-Fehlversuch → LOGIN_FAILED Event
- Portal probt 4× fremde Customer-IDs → 4× ACCESS_DENIED
- SSRF-Probe (169.254.169.254) → SSRF_BLOCKED Event
- 12× LOGIN_FAILED simuliert → Cron erzeugt CRITICAL nach ≤60s
- CRITICAL-Sofort-Alert binnen 30s zugestellt
- Test-Alert-Button: E-Mail zugestellt
- Hourly-Digest mit 5 Events: E-Mail mit Tabelle zugestellt

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/services/api.ts

@@ -1426,6 +1426,71 @@ export interface EmailLog {
   sentAt: string;
 }
 
+// ==================== MONITORING ====================
+
+export type SecurityEventType =
+  | 'LOGIN_FAILED' | 'LOGIN_SUCCESS' | 'RATE_LIMIT_HIT' | 'ACCESS_DENIED'
+  | 'SSRF_BLOCKED' | 'PASSWORD_RESET_REQUEST' | 'PASSWORD_RESET_CONFIRM'
+  | 'LOGOUT' | 'TOKEN_REJECTED' | 'PERMISSION_CHANGED' | 'SUSPICIOUS';
+
+export type SecuritySeverity = 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
+
+export interface SecurityEvent {
+  id: number;
+  type: SecurityEventType;
+  severity: SecuritySeverity;
+  message: string;
+  ipAddress: string | null;
+  userId: number | null;
+  customerId: number | null;
+  userEmail: string | null;
+  endpoint: string | null;
+  details: Record<string, unknown> | null;
+  alerted: boolean;
+  alertedAt: string | null;
+  createdAt: string;
+}
+
+export interface MonitoringSettings {
+  alertEmail: string;
+  digestEnabled: boolean;
+  lastDigestAt: string | null;
+}
+
+export const monitoringApi = {
+  getEvents: async (params?: { page?: number; limit?: number; type?: SecurityEventType | ''; severity?: SecuritySeverity | ''; search?: string; ip?: string; since?: string }) => {
+    const q = new URLSearchParams();
+    if (params?.page) q.set('page', String(params.page));
+    if (params?.limit) q.set('limit', String(params.limit));
+    if (params?.type) q.set('type', params.type);
+    if (params?.severity) q.set('severity', params.severity);
+    if (params?.search) q.set('search', params.search);
+    if (params?.ip) q.set('ip', params.ip);
+    if (params?.since) q.set('since', params.since);
+    const res = await api.get<ApiResponse<SecurityEvent[]> & {
+      pagination: { page: number; limit: number; total: number; totalPages: number };
+      stats: { byType: Record<string, number>; bySeverity: Record<string, number> };
+    }>(`/monitoring/events?${q}`);
+    return res.data;
+  },
+  getSettings: async () => {
+    const res = await api.get<ApiResponse<MonitoringSettings>>('/monitoring/settings');
+    return res.data;
+  },
+  updateSettings: async (data: { alertEmail?: string; digestEnabled?: boolean }) => {
+    const res = await api.put<ApiResponse<void>>('/monitoring/settings', data);
+    return res.data;
+  },
+  testAlert: async () => {
+    const res = await api.post<ApiResponse<void>>('/monitoring/test-alert');
+    return res.data;
+  },
+  runDigest: async () => {
+    const res = await api.post<ApiResponse<{ sent: boolean; eventCount: number; reason?: string }>>('/monitoring/run-digest');
+    return res.data;
+  },
+};
+
 export const emailLogApi = {
   getLogs: async (params?: { page?: number; limit?: number; success?: string; search?: string; context?: string }) => {
     const query = new URLSearchParams();