F-12 Cache-Control + F-14 Favicon

- F-12: HTML-Antworten erhalten 'Cache-Control: no-store' (Formulare/Session
  nicht cachebar); statische Assets bleiben cachebar.
- F-14: Favicon (bi-globe2 als SVG, Logo-Farbe) inkl. /favicon.ico-Route und
  <link rel="icon"> in allen Templates -> kein 404-Rauschen mehr.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/main.py

@@ -57,6 +57,9 @@ def _security_headers(resp):
     resp.headers['X-Content-Type-Options'] = 'nosniff'
     resp.headers['Referrer-Policy'] = 'no-referrer'
     resp.headers.setdefault('Content-Security-Policy', CSP)
+    # HTML-Seiten (Formulare/Session-Daten) nicht cachen lassen.
+    if resp.mimetype == 'text/html':
+        resp.headers['Cache-Control'] = 'no-store'
     return resp
 
 
@@ -225,6 +228,11 @@ def index():
     return redirect(url_for('dashboard') if 'admin_id' in session else url_for('login'))
 
 
+@app.route('/favicon.ico')
+def favicon():
+    return app.send_static_file('favicon.svg')
+
+
 @app.route('/login', methods=['GET', 'POST'])
 def login():
     if request.method == 'POST':