fix: Audit-Bugfixes (Auth/WAF/Firewall/Cluster/Renderer) — v1.2.94

Verifizierte Bugs aus dem Code-Audit behoben (je mit Test/Build/nft -c geprüft):
- session: IssueWithRoleTTL mutierte geteiltes s.TTL (Data-Race + falsche TTL) → interne issue(); -race-Test.
- auth: Fallback/Federation leiteten role/TOTP nicht aus DB ab (2FA-Bypass auf Secondary, Rolle aus Remote) → viaDB-Flag + DB-Re-Lookup.
- waf: TrustedProxies waren No-op (bogus-Direktive) → XFF-Auflösung im SPOE-Agent (rightmostXFF/ipMatchesAny); RuleExclusions/TrustedProxies validiert (Direktiven-Injection); GetForHost via net.SplitHostPort.
- firewall: Auto-Rule mit IPv6-DstIP erzeugte 'ip daddr <v6>' → bricht ganzes nft-Ruleset; jetzt familienbewusst (ip/ip6, ungültige raus).
- kea: 'interfaces': null bei 0 Subnets → leeres Array.
- cluster_repair: nodeHasPublication schluckte DB-Fehler (Resync auf falschem Node) → (bool,error) fail-closed; IPv6-Primary-URL via net.JoinHostPort.
- cluster_replication: Replikations-Passwort via stdin statt psql -c (nicht mehr in argv/Logs).
- wireguard: Config (Private Key) jetzt configgen.AtomicWrite VOR Symlink/enable; SkipReload-Feld.
- render.go: --no-reload jetzt für alle Renderer (squid/unbound/chrony/wireguard).
- radius: leeres Secret/Passwort + Newlines abgelehnt; freeradius confEscape strippt CR/LF.
- configorch: continue-on-error + errors.Join statt Abbruch mitten in der Sequenz.
- i18n: fehlender Key common.status (de/en).
Verworfen als kein Bug: WAF detection-'blocked' (DetectionOnly liefert keine Interruption), render secrets.New('') (nutzt Default-Masterkey), FanOut-Sort (nur Kommentar), pg_hba (durch nft abgesichert).
Offen/bewusst zurückgestellt (low/risk): AlertWriter-Close (langlebiger Worker, vernachlässigbar), Rolling-Update-Kleinkram (sudoers-gebundener Script-Pfad / GET-State).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/services/session/session.go

@@ -96,14 +96,15 @@ func loadOrCreateSecret(path string) ([]byte, error) {
 	return secret, nil
 }
 
-// IssueWithRole returns a signed token for the given actor + role.
-func (s *Signer) IssueWithRole(actor, role string) (string, *Token, error) {
+// issue builds + signs a token with an explicit TTL. No shared-state
+// mutation — safe for concurrent use of the shared Signer singleton.
+func (s *Signer) issue(actor, role string, ttl time.Duration) (string, *Token, error) {
 	now := s.Now()
 	t := Token{
 		Actor: actor,
 		Role:  role,
 		Iat:   now.Unix(),
-		Exp:   now.Add(s.TTL).Unix(),
+		Exp:   now.Add(ttl).Unix(),
 	}
 	data, err := json.Marshal(t)
 	if err != nil {
@@ -117,18 +118,20 @@ func (s *Signer) IssueWithRole(actor, role string) (string, *Token, error) {
 	return encoded, &t, nil
 }
 
-// Issue is IssueWithRole with empty role.
-func (s *Signer) Issue(actor string) (string, *Token, error) {
-	return s.IssueWithRole(actor, "")
+// IssueWithRole returns a signed token for the given actor + role.
+func (s *Signer) IssueWithRole(actor, role string) (string, *Token, error) {
+	return s.issue(actor, role, s.TTL)
 }
 
-// IssueWithRoleTTL issues a token with a custom TTL (overrides s.TTL for this call).
+// Issue is IssueWithRole with empty role.
+func (s *Signer) Issue(actor string) (string, *Token, error) {
+	return s.issue(actor, "", s.TTL)
+}
+
+// IssueWithRoleTTL issues a token with a custom TTL — no longer mutates
+// the shared Signer (previously a data race under concurrent logins).
 func (s *Signer) IssueWithRoleTTL(actor, role string, ttl time.Duration) (string, *Token, error) {
-	orig := s.TTL
-	s.TTL = ttl
-	raw, tok, err := s.IssueWithRole(actor, role)
-	s.TTL = orig
-	return raw, tok, err
+	return s.issue(actor, role, ttl)
 }
 
 // Verify checks a token. Returns ErrInvalidToken or ErrExpiredToken.