feat(auth): sessions end when they should; logins are throttled; Secure behind HTTPS (#5035)

#5035 "Sessions: lifetime applied, role and is_active re-read per request,
logout is a POST, failed logins throttled".

- steward/core/proxy.py: trusted_value / is_https / client_ip read
  X-Forwarded-Proto and -For only as far as the trusted proxy hops
  (Settings → General, default 1, 0 = trust none).
- The session cookie is Secure, and HSTS is sent, only on requests that
  arrived over HTTPS by that rule; plain-HTTP and LAN use are unchanged
  and nothing redirects.
- A login lasts Settings → General's session lifetime from when it began
  (session.permanent + a login_at stamp checked every request — the
  cookie's own age slides on every response). A deleted or deactivated
  user is logged out on their next request; a role change applies at once.
- Logout is a POST (a form in the sidebar); GET /logout is gone.
- Failed logins pause an address after login.max_failures within
  login.lockout_minutes (Settings → General; defaults 5 in 15 min),
  keyed by address so nobody can lock a user out by name. Failures are
  audited as auth.login_failed with the address.
- to_access_cfg projects the new settings into app.config at startup and
  on save, beside the existing projections.
- Integration tests seed real users and a login_at, since every request
  now re-reads the session's user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/base.html

@@ -93,15 +93,17 @@ code { font-family: ui-monospace, monospace; font-size: 0.875em; background: var
   background: color-mix(in srgb, var(--gold) 8%, transparent);
 }
 .side-user { border-top: 1px solid var(--border); padding: 0.7rem 1.25rem; }
-.side-user a {
+.side-user form { margin: 0; }
+.side-user button {
   color: var(--text-muted); font-size: 0.84rem; text-decoration: none;
   display: flex; align-items: center; gap: 0.4rem;
+  background: none; border: 0; padding: 0; font-family: inherit; cursor: pointer;
 }
-.side-user a:hover { color: var(--text); }
+.side-user button:hover { color: var(--text); }
 /* Keyboard focus: a clear inset ring on every interactive sidebar element. */
 .sidebar .brand:focus-visible,
 .side-nav a:focus-visible,
-.side-user a:focus-visible {
+.side-user button:focus-visible {
   outline: 2px solid var(--accent); outline-offset: -2px; color: var(--text);
 }
 .app-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
@@ -332,7 +334,9 @@ body.dash-editing .widget-drawer { transform:translateY(0); }
       {% endif %}
     </nav>
     <div class="side-user">
-      <a href="/logout" title="Log out">⏻ {{ session.username }}</a>
+      <form method="post" action="/logout">{{ csrf_field() }}
+        <button type="submit" title="Log out">⏻ {{ session.username }}</button>
+      </form>
     </div>
   </aside>
 {% endif %}

steward/templates/settings/general.html

@@ -21,10 +21,35 @@
     </div>
   </div>
 
+  <div class="form-group">
+    <label>Trusted reverse proxies</label>
+    <input type="number" name="general.trusted_proxy_hops" min="0" max="5"
+           value="{{ settings['general.trusted_proxy_hops'] }}" style="max-width:120px;">
+    <div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">
+      How many proxies sit in front of Steward (e.g. 1 for Traefik, 2 for Cloudflare in front of Traefik).
+      Steward believes their X-Forwarded-For and X-Forwarded-Proto headers up to that many hops: it marks
+      the login cookie Secure and sends HSTS only when they report HTTPS, and throttles logins by the address
+      they report. 0 trusts no proxy.
+    </div>
+  </div>
+
   <div class="form-group">
     <label>Session lifetime <span style="color:var(--text-muted);font-size:0.8rem;">(hours)</span></label>
     <input type="number" name="session.lifetime_hours" min="1" max="720"
            value="{{ settings['session.lifetime_hours'] }}" style="max-width:120px;">
+    <div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.25rem;">A login lasts this long; then Steward asks for the password again.</div>
+  </div>
+
+  <div class="form-group">
+    <label>Failed logins before a pause</label>
+    <div style="display:flex;gap:0.5rem;align-items:center;flex-wrap:wrap;">
+      <input type="number" name="login.max_failures" min="1" max="100"
+             value="{{ settings['login.max_failures'] }}" style="max-width:90px;">
+      <span style="font-size:0.85rem;color:var(--text-muted);">failures from one address pause its logins for</span>
+      <input type="number" name="login.lockout_minutes" min="1" max="1440"
+             value="{{ settings['login.lockout_minutes'] }}" style="max-width:90px;">
+      <span style="font-size:0.85rem;color:var(--text-muted);">minutes</span>
+    </div>
   </div>
 
   <div class="form-group">