Fix sites freeze bug, add features and shorten README

Bug fixes:
- UniFiController: add CURLOPT_TIMEOUT (10s) and CURLOPT_CONNECTTIMEOUT (5s)
  to login() and apiRequest() — prevents page freeze when controller unreachable
- UniFiController: fix login response validation for UniFi OS API which returns
  a user object instead of meta.rc=ok
- admin/sites.php: add JS loading state on form submit to give visual feedback
- login.php: handle new 'rate_limited' return value from Auth::login()

New features:
- Database: in-memory settings cache eliminates redundant DB queries per request
- Auth: login rate limiting (10 attempts per 10 min per IP/email) via login_attempts table
- admin/vouchers.php: CSV export with UTF-8 BOM for Excel compatibility
- admin/vouchers.php: client-side pagination (50 per page)
- index.php: QR code display after voucher creation (qrcodejs CDN)
- Mailer: sendTestEmail() method
- admin/settings.php: SMTP test button with AJAX handler
- database.sql: add login_attempts and audit_log tables

Readme: condensed from ~420 to ~220 lines, removed duplicated sections,
M365 Azure Portal walkthrough, contribution guidelines, update/migration section

https://claude.ai/code/session_01UsuvFAmmeagtQa14QA4iaq

includes/Auth.php

@@ -23,19 +23,62 @@ class Auth {
     
     // Benutzer einloggen
     public function login($email, $password) {
+        $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+
+        if ($this->isRateLimited($ip, $email)) {
+            return 'rate_limited';
+        }
+
         $user = $this->db->fetchOne(
             "SELECT * FROM users WHERE email = ? AND is_active = 1",
             [$email]
         );
-        
+
         if ($user && password_verify($password, $user['password_hash'])) {
+            $this->clearLoginAttempts($ip, $email);
             $this->setUserSession($user);
             $this->updateLastLogin($user['id']);
             return true;
         }
-        
+
+        $this->recordLoginAttempt($ip, $email);
         return false;
     }
+
+    private function isRateLimited($ip, $email) {
+        try {
+            $count = $this->db->fetchOne(
+                "SELECT COUNT(*) as cnt FROM login_attempts
+                 WHERE (ip_address = ? OR email = ?) AND attempted_at > DATE_SUB(NOW(), INTERVAL 10 MINUTE)",
+                [$ip, $email]
+            );
+            return $count && (int)$count['cnt'] >= 10;
+        } catch (\Exception $e) {
+            return false;
+        }
+    }
+
+    private function recordLoginAttempt($ip, $email) {
+        try {
+            $this->db->query(
+                "INSERT INTO login_attempts (ip_address, email) VALUES (?, ?)",
+                [$ip, $email]
+            );
+        } catch (\Exception $e) {
+            // Tabelle existiert noch nicht – ignorieren
+        }
+    }
+
+    private function clearLoginAttempts($ip, $email) {
+        try {
+            $this->db->query(
+                "DELETE FROM login_attempts WHERE ip_address = ? OR email = ?",
+                [$ip, $email]
+            );
+        } catch (\Exception $e) {
+            // ignore
+        }
+    }
     
     // Microsoft 365 Login
     public function loginWithMicrosoft($microsoftUser) {

includes/Database.php

@@ -2,6 +2,7 @@
 class Database {
     private static $instance = null;
     private $pdo;
+    private $settingsCache = [];
     
     private function __construct() {
         try {
@@ -58,15 +59,21 @@ class Database {
     
     // Settings-Helper
     public function getSetting($key, $default = null) {
+        if (array_key_exists($key, $this->settingsCache)) {
+            return $this->settingsCache[$key] ?? $default;
+        }
         $result = $this->fetchOne("SELECT setting_value FROM settings WHERE setting_key = ?", [$key]);
-        return $result ? $result['setting_value'] : $default;
+        $value = $result ? $result['setting_value'] : null;
+        $this->settingsCache[$key] = $value;
+        return $value ?? $default;
     }
-    
+
     public function setSetting($key, $value) {
         $this->query(
-            "INSERT INTO settings (setting_key, setting_value) VALUES (?, ?) 
+            "INSERT INTO settings (setting_key, setting_value) VALUES (?, ?)
              ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)",
             [$key, $value]
         );
+        $this->settingsCache[$key] = $value;
     }
 }

includes/Mailer.php

@@ -201,6 +201,13 @@ class Mailer {
         return $this->send($to, $subject, $body, $isHtml);
     }
     
+    public function sendTestEmail($to) {
+        $appTitle = $this->db->getSetting('app_title', 'UniFi Voucher System');
+        $subject = '[Test] E-Mail-Konfiguration – ' . $appTitle;
+        $body = "Dies ist eine Test-E-Mail von {$appTitle}.\n\nDie SMTP-Konfiguration ist korrekt eingerichtet.";
+        return $this->send($to, $subject, $body, false);
+    }
+
     public function sendUserNotification($to, $userName, $changes) {
         $appTitle = $this->db->getSetting('app_title', 'UniFi Voucher System');
         

includes/UniFiController.php

@@ -36,6 +36,8 @@ class UniFiController {
             CURLOPT_SSL_VERIFYPEER => false,
             CURLOPT_COOKIEJAR => $this->cookieFile,
             CURLOPT_COOKIEFILE => $this->cookieFile,
+            CURLOPT_TIMEOUT => 10,
+            CURLOPT_CONNECTTIMEOUT => 5,
             CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
             CURLOPT_HEADERFUNCTION => function($ch, $header) {
                 $parts = explode(':', $header, 2);
@@ -59,11 +61,15 @@ class UniFiController {
         }
         
         $data = json_decode($response, true);
-        
-        if (!isset($data['meta']['rc']) || $data['meta']['rc'] !== 'ok') {
-            throw new Exception("Login fehlgeschlagen: Ungültige Antwort");
+
+        // UniFi OS gibt ein User-Objekt zurück (unique_id/email), die alte API meta.rc = ok
+        $isUnifiOs = is_array($data) && (isset($data['unique_id']) || isset($data['email']));
+        $isOldApi  = isset($data['meta']['rc']) && $data['meta']['rc'] === 'ok';
+
+        if (!$isUnifiOs && !$isOldApi) {
+            throw new Exception("Login fehlgeschlagen: Ungültige Antwort vom Controller");
         }
-        
+
         return true;
     }
     
@@ -79,6 +85,8 @@ class UniFiController {
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_SSL_VERIFYPEER => false,
             CURLOPT_COOKIEFILE => $this->cookieFile,
+            CURLOPT_TIMEOUT => 10,
+            CURLOPT_CONNECTTIMEOUT => 5,
             CURLOPT_HTTPHEADER => array_filter([
                 'Content-Type: application/json',
                 ($method === 'POST' && $this->csrfToken !== null)