feat(auth): sessions end when they should; logins are throttled; Secure behind HTTPS (#5035)

#5035 "Sessions: lifetime applied, role and is_active re-read per request,
logout is a POST, failed logins throttled".

- steward/core/proxy.py: trusted_value / is_https / client_ip read
  X-Forwarded-Proto and -For only as far as the trusted proxy hops
  (Settings → General, default 1, 0 = trust none).
- The session cookie is Secure, and HSTS is sent, only on requests that
  arrived over HTTPS by that rule; plain-HTTP and LAN use are unchanged
  and nothing redirects.
- A login lasts Settings → General's session lifetime from when it began
  (session.permanent + a login_at stamp checked every request — the
  cookie's own age slides on every response). A deleted or deactivated
  user is logged out on their next request; a role change applies at once.
- Logout is a POST (a form in the sidebar); GET /logout is gone.
- Failed logins pause an address after login.max_failures within
  login.lockout_minutes (Settings → General; defaults 5 in 15 min),
  keyed by address so nobody can lock a user out by name. Failures are
  audited as auth.login_failed with the address.
- to_access_cfg projects the new settings into app.config at startup and
  on save, beside the existing projections.
- Integration tests seed real users and a login_at, since every request
  now re-reads the session's user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/base.html

@@ -93,15 +93,17 @@ code { font-family: ui-monospace, monospace; font-size: 0.875em; background: var
   background: color-mix(in srgb, var(--gold) 8%, transparent);
 }
 .side-user { border-top: 1px solid var(--border); padding: 0.7rem 1.25rem; }
-.side-user a {
+.side-user form { margin: 0; }
+.side-user button {
   color: var(--text-muted); font-size: 0.84rem; text-decoration: none;
   display: flex; align-items: center; gap: 0.4rem;
+  background: none; border: 0; padding: 0; font-family: inherit; cursor: pointer;
 }
-.side-user a:hover { color: var(--text); }
+.side-user button:hover { color: var(--text); }
 /* Keyboard focus: a clear inset ring on every interactive sidebar element. */
 .sidebar .brand:focus-visible,
 .side-nav a:focus-visible,
-.side-user a:focus-visible {
+.side-user button:focus-visible {
   outline: 2px solid var(--accent); outline-offset: -2px; color: var(--text);
 }
 .app-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
@@ -332,7 +334,9 @@ body.dash-editing .widget-drawer { transform:translateY(0); }
       {% endif %}
     </nav>
     <div class="side-user">
-      <a href="/logout" title="Log out">⏻ {{ session.username }}</a>
+      <form method="post" action="/logout">{{ csrf_field() }}
+        <button type="submit" title="Log out">⏻ {{ session.username }}</button>
+      </form>
     </div>
   </aside>
 {% endif %}