Merge pull request #10 from friloo/claude/ecstatic-cannon-H5hGy

Security-Härtung, Auto-Updater, UI-Features & erweiterte Funktionen (v2.3.0)
2026-06-09 21:31:15 +02:00 · 2026-06-09 21:31:15 +02:00 · bad70a631f
commit bad70a631f
parent f747a3d429 87af72e51c
63 changed files with 3127 additions and 32 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,9 @@
+.git
+.github
+docs
+*.md
+config.php
+updater/storage/.version
+updater/storage/.maintenance
+updater/storage/.update-staging
+updater/storage/updater-settings.json
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -0,0 +1,57 @@
+name: CI
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+
+jobs:
+  lint:
+    name: PHP Lint
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php: [ "7.4", "8.2" ]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP ${{ matrix.php }}
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: pdo, pdo_mysql, curl, mbstring, json
+          coverage: none
+
+      - name: Syntax check all PHP files
+        run: |
+          set -e
+          find . -name '*.git' -prune -o -name '*.php' -print | while read -r f; do
+            php -l "$f"
+          done
+
+      - name: Validate JSON language/migration assets
+        run: |
+          php -r 'foreach (glob("lang/*.php") as $f) { $a = require $f; if (!is_array($a)) { fwrite(STDERR, "Bad lang file: $f\n"); exit(1);} } echo "lang OK\n";'
+
+  test:
+    name: Unit Tests & Static Analysis
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP 8.2
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.2"
+          extensions: pdo, pdo_mysql, curl, mbstring, json
+          tools: composer
+          coverage: none
+
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress
+
+      - name: PHPUnit
+        run: vendor/bin/phpunit
+
+      - name: PHPStan
+        run: vendor/bin/phpstan analyse --no-progress
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@ -0,0 +1,39 @@
+name: Docker Publish
+
+on:
+  push:
+    tags: [ "v*" ]
+  workflow_dispatch:
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,14 @@
+# Dev-/Test-Abhängigkeiten (Laufzeit braucht KEIN composer)
+/vendor/
+composer.lock
+.phpunit.result.cache
+.phpunit.cache/
+
+# Updater-Laufzeitdaten
+/updater/storage/.version
+/updater/storage/.maintenance
+/updater/storage/.update-progress
+/updater/storage/.update.zip
+/updater/storage/.update-staging/
+/updater/storage/.migrations-lock
+/updater/storage/updater-settings.json
--- a/36
+++ b/36
@ -0,0 +1,36 @@
+# UniFi Voucher Management System – Container-Image
+FROM php:8.2-apache
+
+# System-Tools (curl für Healthcheck) + PHP-Extensions
+RUN apt-get update && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && docker-php-ext-install pdo pdo_mysql \
+    && a2enmod rewrite headers
+
+# Empfohlene PHP-Einstellungen
+RUN { \
+      echo 'display_errors=0'; \
+      echo 'log_errors=1'; \
+      echo 'expose_php=0'; \
+      echo 'upload_max_filesize=8M'; \
+      echo 'post_max_size=8M'; \
+    } > /usr/local/etc/php/conf.d/zz-voucher.ini
+
+WORKDIR /var/www/html
+COPY . /var/www/html
+
+# Laufzeit-Verzeichnis des Updaters beschreibbar machen
+RUN mkdir -p /var/www/html/updater/storage \
+    && chown -R www-data:www-data /var/www/html
+
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+EXPOSE 80
+
+# Apache-Worker laufen als www-data (Privilege-Drop durch den Master).
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD curl -fsS http://localhost/health.php || exit 1
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["apache2-foreground"]
--- a/Readme.md
+++ b/Readme.md
@ -8,7 +8,8 @@
 ![MySQL](https://img.shields.io/badge/MySQL-5.7%2B%20%2F%20MariaDB-4479A1?logo=mysql&logoColor=white)
 ![UniFi OS](https://img.shields.io/badge/UniFi%20OS-7.0%2B-0559C9?logo=ubiquiti&logoColor=white)
 ![License](https://img.shields.io/badge/Lizenz-MIT-green)
-![Version](https://img.shields.io/badge/Version-2.1.0-blueviolet)
+![Version](https://img.shields.io/badge/Version-2.4.0-blueviolet)
+![CI](https://github.com/friloo/unifi-voucher-tool/actions/workflows/ci.yml/badge.svg)

 </div>

@ -29,7 +30,20 @@
 - 🏢 **Multi-Site-Support** – beliebig viele UniFi-Standorte zentral verwalten
 - 👥 **Benutzerverwaltung** mit granularer Site-Zugriffskontrolle
 - 🔐 **Authentifizierung** via lokale Accounts **oder** Microsoft 365 OAuth
+- 🔒 **2FA (TOTP)** – optional, mit Recovery-Codes & erzwingbarer Admin-Pflicht
+- 📈 **Reporting** – Auswertungen mit Charts und CSV-/PDF-Export
+- 🩺 **Health-Endpoint** (`/health.php`) für Monitoring/Uptime
 - 🔑 **Passwort-Reset** per E-Mail (token-basiert, zeitlich begrenzt)
+- 🚦 **Bandbreiten- & Datenlimits** pro Voucher/Profil (UniFi QoS)
+- 🧰 **REST-API mit API-Schlüsseln** – Scopes (read/write), Rate-Limit, OpenAPI-Spec
+- 🪪 **Single Sign-On** via generisches OpenID Connect (zusätzlich zu M365)
+- 📲 **SMS-Versand** der Codes (Twilio) · **CSV-Batch-Import** von Vouchern
+- 🤖 **CAPTCHA** (Rechenaufgabe oder hCaptcha) im öffentlichen Modus
+- 🗄️ **DB-gestützte Sessions** (opt-in) mit „überall abmelden"
+- 🔔 **Webhooks** (Slack / Teams / generisch) für Erstellung, Ausfälle, neue Login-IP
+- 🧹 **Auto-Cleanup & DSGVO** – Aufbewahrungsfristen per Cron
+- 💾 **Config-Backup & -Restore** (JSON Export/Import)
+- 🐳 **Docker** – Dockerfile + docker-compose (MariaDB)
 - 🌍 **Öffentlicher Modus** – optional ohne Login nutzbar (mit CSRF-Schutz & Throttle)
 - 🌗 **Dark Mode** – umschaltbar, Einstellung wird im Browser gespeichert
 - 🌐 **Mehrsprachig** – Deutsch / Englisch per Umschalter (`lang/`)
@ -72,6 +86,17 @@
  <img src="docs/screenshots/maintenance.png" alt="Wartungsmodus" width="48%">
 </div>

+### REST-API, 2FA & Integrationen
+
+<div align="center">
+  <img src="docs/screenshots/api-keys.png" alt="API-Schlüssel-Verwaltung" width="48%">
+  <img src="docs/screenshots/integrations.png" alt="Integration & Wartung" width="48%">
+</div>
+
+<div align="center">
+  <img src="docs/screenshots/two-factor.png" alt="Zwei-Faktor-Authentifizierung" width="60%">
+</div>
+
 ---

 ## 📋 Anforderungen
@ -286,6 +311,59 @@ Body: {"cmd": "delete-voucher", "_id": "<voucher_id>"}

 ---

+## 🧰 REST-API
+
+Voucher lassen sich programmatisch erstellen (z. B. aus Buchungssystemen oder
+Self-Service-Terminals). Schlüssel werden unter **Administration → API-Schlüssel**
+verwaltet. Authentifizierung per `Authorization: Bearer <key>` oder `X-API-Key`.
+
+```bash
+# Voucher erstellen
+curl -X POST https://ihre-domain.de/api/vouchers.php \
+  -H "Authorization: Bearer uvt_…" \
+  -H "Content-Type: application/json" \
+  -d '{"site_id":1,"name":"API Gast","max_uses":1,"expire_minutes":480,
+       "qos":{"down":10000,"up":2000,"quota_mb":500}}'
+
+# Sites auflisten
+curl https://ihre-domain.de/api/sites.php -H "X-API-Key: uvt_…"
+
+# Voucher einer Site abrufen
+curl "https://ihre-domain.de/api/vouchers.php?site_id=1" -H "X-API-Key: uvt_…"
+```
+
+| Methode | Endpunkt | Zweck |
+|---|---|---|
+| `POST` | `/api/vouchers.php` | Voucher erstellen (optional mit QoS-Limits) |
+| `GET`  | `/api/vouchers.php?site_id=<id>` | Voucher einer Site auflisten |
+| `GET`  | `/api/sites.php` | Aktive Sites auflisten |
+
+## 🔒 2FA, Webhooks & Wartung
+
+- **2FA:** Unter **Administration → Sicherheit (2FA)** aktivierbar – QR-Code
+  scannen, Code bestätigen. Danach wird bei jeder Anmeldung ein Authenticator-
+  Code abgefragt.
+- **Webhooks & Trusted-Proxy & Datenhaltung:** unter **Administration →
+  Integration & Wartung** konfigurierbar.
+- **Auto-Cleanup (DSGVO):** täglicher Cron, löscht abgelaufene Voucher,
+  Audit-Log, Login-Versuche nach einstellbaren Fristen:
+  ```bash
+  0 3 * * * curl -s "https://ihre-domain.de/cron_cleanup.php?token=IHR_CRON_TOKEN"
+  ```
+
+## 🐳 Docker
+
+```bash
+# APP_KEY erzeugen und in docker-compose.yml eintragen:
+php -r 'echo base64_encode(random_bytes(32))."\n";'
+
+docker compose up -d        # App auf http://localhost:8080
+```
+
+Das Schema wird beim ersten Start automatisch in MariaDB geladen; danach den
+Installer (`/install.php`) für den Admin-Account aufrufen oder Config per ENV
+setzen (`DB_*`, `APP_KEY`).
+
 ## 🗺️ Roadmap

 - [x] Voucher-Templates (vordefinierte Laufzeiten)
@ -295,13 +373,16 @@ Body: {"cmd": "delete-voucher", "_id": "<voucher_id>"}
 - [x] Passwort-Reset
 - [x] Audit-Log
 - [x] Auto-Updater mit DB-Migrationen
- [ ] Erweiterte Reporting-Funktionen
- [ ] Docker-Container
+- [x] REST-API mit API-Schlüsseln
+- [x] 2FA (TOTP), Webhooks, Bandbreitenlimits
+- [x] Docker-Container
+- [x] Erweiterte Reporting-Funktionen (CSV/PDF) + Health-Endpoint
+- [x] 2FA-Recovery-Codes, API-Scopes/Rate-Limit/OpenAPI, Test-Suite (PHPUnit/PHPStan)

 ---

 <div align="center">

-**Version 2.1.0** · Autor: **Friederich Loheide** · Lizenz: **MIT**
+**Version 2.4.0** · Autor: **Friederich Loheide** · Lizenz: **MIT**

 </div>
--- a/admin/api_keys.php
+++ b/admin/api_keys.php
@ -0,0 +1,171 @@
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/Auth.php';
+require_once __DIR__ . '/../includes/ApiKey.php';
+require_once __DIR__ . '/../includes/I18n.php';
+
+$auth = new Auth();
+$auth->requireAdmin();
+I18n::init();
+
+$db = Database::getInstance();
+$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
+
+$error = '';
+$success = '';
+$newKey = '';
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_key'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = __('error_csrf');
+    } else {
+        $name = trim($_POST['name'] ?? '');
+        if ($name === '') {
+            $error = __('error_name_req');
+        } else {
+            $scope = ($_POST['scope'] ?? 'write') === 'read' ? 'read' : 'write';
+            $rate  = max(0, (int)($_POST['rate_limit'] ?? 0));
+            $k = ApiKey::generate();
+            $db->execute(
+                "INSERT INTO api_keys (name, key_prefix, key_hash, scope, rate_limit, created_by) VALUES (?, ?, ?, ?, ?, ?)",
+                [$name, $k['prefix'], $k['hash'], $scope, $rate, $_SESSION['user_id']]
+            );
+            $auth->writeAuditLog($_SESSION['user_id'], 'api_key_create', 'api_key', null, "API-Key '$name' erstellt");
+            $newKey = $k['plain'];
+            $success = 'API-Schlüssel erstellt. Bitte JETZT kopieren – er wird nur einmal angezeigt!';
+        }
+    }
+}
+
+if (isset($_GET['toggle']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) {
+    $row = $db->fetchOne("SELECT is_active FROM api_keys WHERE id = ?", [(int)$_GET['toggle']]);
+    if ($row) {
+        $db->query("UPDATE api_keys SET is_active = ? WHERE id = ?", [$row['is_active'] ? 0 : 1, (int)$_GET['toggle']]);
+        $success = 'Status aktualisiert.';
+    }
+}
+
+if (isset($_GET['delete']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) {
+    $db->query("DELETE FROM api_keys WHERE id = ?", [(int)$_GET['delete']]);
+    $auth->writeAuditLog($_SESSION['user_id'], 'api_key_delete', 'api_key', (int)$_GET['delete'], 'API-Key gelöscht');
+    $success = 'API-Schlüssel gelöscht.';
+}
+
+$keys = $db->fetchAll("SELECT k.*, u.name AS creator FROM api_keys k LEFT JOIN users u ON k.created_by = u.id ORDER BY k.created_at DESC");
+$csrf = $auth->getCsrfToken();
+$currentPage = 'api_keys';
+$adminBase   = '';
+?>
+<!DOCTYPE html>
+<html lang="<?= I18n::getLanguage() ?>">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>API-Schlüssel – <?= htmlspecialchars($appTitle) ?></title>
+<?php require __DIR__ . '/../includes/admin_nav.php'; ?>
+<style>
+.card { background: var(--bg-card); border:1px solid var(--border-color); border-radius:14px; padding:24px; margin-bottom:22px; box-shadow:0 4px 14px var(--shadow); }
+.card h2 { font-size:16px; margin-bottom:16px; color:var(--text-primary); }
+table { width:100%; border-collapse:collapse; }
+th,td { text-align:left; padding:11px 8px; font-size:14px; border-bottom:1px solid var(--border-color); color:var(--text-primary); }
+th { color:var(--text-muted); font-weight:600; }
+code { font-family:monospace; background:var(--bg-hover); padding:2px 6px; border-radius:5px; }
+.btn { padding:10px 16px; border:none; border-radius:8px; font-weight:600; cursor:pointer; font-size:14px; text-decoration:none; display:inline-block; }
+.btn-primary { background:var(--accent,#667eea); color:#fff; }
+.input { width:100%; padding:11px; border:2px solid var(--border-color); border-radius:8px; background:var(--bg-input,#fff); color:var(--text-primary); font-size:14px; }
+.alert { padding:12px 14px; border-radius:9px; font-size:14px; margin-bottom:18px; }
+.alert-error { background:#fee; border:1px solid #fcc; color:#c33; }
+.alert-ok { background:#efe; border:1px solid #cfc; color:#2a7; }
+.keybox { background:#0f1117; color:#7CFFB2; font-family:monospace; padding:14px; border-radius:8px; word-break:break-all; font-size:15px; margin-top:10px; }
+.badge { padding:3px 9px; border-radius:6px; font-size:12px; font-weight:600; }
+.b-on { background:#e3f6ea; color:#2a7; } .b-off { background:#fdeaea; color:#c33; }
+.a-link { color:var(--accent,#667eea); text-decoration:none; margin-right:10px; font-size:13px; }
+.muted { color:var(--text-muted); font-size:13px; }
+</style>
+</head>
+<body>
+<h1 style="font-size:24px;margin-bottom:20px;color:var(--text-primary);">🔑 API-Schlüssel</h1>
+
+<?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+<?php if ($success): ?><div class="alert alert-ok"><?= htmlspecialchars($success) ?></div><?php endif; ?>
+
+<?php if ($newKey): ?>
+<div class="card">
+    <h2>Neuer Schlüssel</h2>
+    <p class="muted">Kopieren Sie ihn jetzt – aus Sicherheitsgründen wird er nicht erneut angezeigt.</p>
+    <div class="keybox"><?= htmlspecialchars($newKey) ?></div>
+</div>
+<?php endif; ?>
+
+<div class="card">
+    <h2>Neuen API-Schlüssel erstellen</h2>
+    <form method="post" style="display:flex;gap:12px;align-items:flex-end;flex-wrap:wrap;">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+        <div style="flex:2;min-width:200px;">
+            <label class="muted" style="display:block;margin-bottom:6px;">Bezeichnung</label>
+            <input class="input" type="text" name="name" placeholder="z.B. Buchungssystem, Terminal Foyer" required>
+        </div>
+        <div style="flex:1;min-width:130px;">
+            <label class="muted" style="display:block;margin-bottom:6px;">Berechtigung</label>
+            <select class="input" name="scope">
+                <option value="write">Lesen + Erstellen</option>
+                <option value="read">Nur Lesen</option>
+            </select>
+        </div>
+        <div style="flex:1;min-width:120px;">
+            <label class="muted" style="display:block;margin-bottom:6px;">Limit (Anfr./min)</label>
+            <input class="input" type="number" name="rate_limit" min="0" value="0" title="0 = unbegrenzt">
+        </div>
+        <button class="btn btn-primary" type="submit" name="create_key">Erstellen</button>
+    </form>
+</div>
+
+<div class="card">
+    <h2>Vorhandene Schlüssel</h2>
+    <?php if (empty($keys)): ?>
+        <p class="muted">Noch keine API-Schlüssel angelegt.</p>
+    <?php else: ?>
+    <table>
+        <tr><th>Name</th><th>Präfix</th><th>Scope</th><th>Limit</th><th>Status</th><th>Zuletzt genutzt</th><th>Erstellt von</th><th></th></tr>
+        <?php foreach ($keys as $k): ?>
+        <tr>
+            <td><?= htmlspecialchars($k['name']) ?></td>
+            <td><code>uvt_<?= htmlspecialchars($k['key_prefix']) ?>…</code></td>
+            <td><?= ($k['scope'] ?? 'write') === 'read' ? 'nur Lesen' : 'Lesen+Erstellen' ?></td>
+            <td><?= (int)($k['rate_limit'] ?? 0) === 0 ? '∞' : (int)$k['rate_limit'] . '/min' ?></td>
+            <td><span class="badge <?= $k['is_active'] ? 'b-on' : 'b-off' ?>"><?= $k['is_active'] ? 'aktiv' : 'gesperrt' ?></span></td>
+            <td class="muted"><?= $k['last_used_at'] ? htmlspecialchars($k['last_used_at']) : '–' ?></td>
+            <td class="muted"><?= htmlspecialchars($k['creator'] ?? '–') ?></td>
+            <td style="text-align:right;white-space:nowrap;">
+                <a class="a-link" href="?toggle=<?= (int)$k['id'] ?>&token=<?= urlencode($csrf) ?>"><?= $k['is_active'] ? 'Sperren' : 'Aktivieren' ?></a>
+                <a class="a-link" style="color:#e25555;" href="?delete=<?= (int)$k['id'] ?>&token=<?= urlencode($csrf) ?>" onclick="return confirm('Schlüssel löschen?');">Löschen</a>
+            </td>
+        </tr>
+        <?php endforeach; ?>
+    </table>
+    <?php endif; ?>
+</div>
+
+<div class="card">
+    <h2>Verwendung</h2>
+    <p class="muted" style="margin-bottom:10px;">Authentifizierung per Header <code>Authorization: Bearer &lt;key&gt;</code> oder <code>X-API-Key: &lt;key&gt;</code>.</p>
+    <pre class="keybox" style="color:#cdd3e0;white-space:pre-wrap;"># Voucher erstellen
+curl -X POST https://IHRE-DOMAIN/api/vouchers.php \
+  -H "Authorization: Bearer uvt_…" \
+  -H "Content-Type: application/json" \
+  -d '{"site_id":1,"name":"API Gast","max_uses":1,"expire_minutes":480}'
+
+# Sites auflisten
+curl https://IHRE-DOMAIN/api/sites.php -H "X-API-Key: uvt_…"</pre>
+    <p class="muted" style="margin-top:12px;">OpenAPI-Spezifikation (Import in Postman/Swagger): <a href="../api/openapi.php" target="_blank">/api/openapi.php</a></p>
+</div>
+
+</div><!-- /main-content -->
+<script src="../assets/global.js"></script>
+</body>
+</html>
--- a/admin/backup.php
+++ b/admin/backup.php
@ -0,0 +1,159 @@
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/Auth.php';
+require_once __DIR__ . '/../includes/I18n.php';
+
+$auth = new Auth();
+$auth->requireAdmin();
+I18n::init();
+
+$db = Database::getInstance();
+$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
+
+$error = '';
+$success = '';
+
+// Export: JSON-Download
+if (isset($_GET['export']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) {
+    $export = [
+        'meta' => [
+            'app'        => 'unifi-voucher-tool',
+            'version'    => '2.2.0',
+            'exported_at'=> date('c'),
+            'note'       => 'Site-Passwörter sind mit dem APP_KEY dieser Installation verschlüsselt.',
+        ],
+        'settings'          => $db->fetchAll("SELECT setting_key, setting_value FROM settings"),
+        'sites'             => $db->fetchAll("SELECT name, site_id, unifi_controller_url, unifi_username, unifi_password, is_active, public_access FROM sites"),
+        'voucher_templates' => $db->fetchAll("SELECT name, max_uses, expire_minutes, description, qos_rate_max_down, qos_rate_max_up, qos_usage_quota, is_active FROM voucher_templates"),
+    ];
+    $auth->writeAuditLog($_SESSION['user_id'], 'config_export', 'config', null, 'Konfiguration exportiert');
+    header('Content-Type: application/json');
+    header('Content-Disposition: attachment; filename="voucher-config-' . date('Y-m-d') . '.json"');
+    echo json_encode($export, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+    exit;
+}
+
+// Import
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['import'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = __('error_csrf');
+    } elseif (empty($_FILES['backup']['tmp_name'])) {
+        $error = 'Bitte eine Backup-Datei auswählen.';
+    } else {
+        $raw  = file_get_contents($_FILES['backup']['tmp_name']);
+        $data = json_decode($raw, true);
+        if (!is_array($data) || ($data['meta']['app'] ?? '') !== 'unifi-voucher-tool') {
+            $error = 'Ungültige oder fremde Backup-Datei.';
+        } else {
+            $importSites     = isset($_POST['import_sites']);
+            $importTemplates = isset($_POST['import_templates']);
+            $importSettings  = isset($_POST['import_settings']);
+            $counts = ['settings' => 0, 'sites' => 0, 'templates' => 0];
+
+            try {
+                if ($importSettings && !empty($data['settings'])) {
+                    foreach ($data['settings'] as $s) {
+                        // Cron-Token NICHT überschreiben (Sicherheit der Ziel-Installation)
+                        if (($s['setting_key'] ?? '') === 'cron_token') continue;
+                        $db->setSetting($s['setting_key'], $s['setting_value']);
+                        $counts['settings']++;
+                    }
+                }
+                if ($importSites && !empty($data['sites'])) {
+                    foreach ($data['sites'] as $s) {
+                        $exists = $db->fetchOne("SELECT id FROM sites WHERE name = ? AND site_id = ?", [$s['name'], $s['site_id']]);
+                        if ($exists) {
+                            $db->query(
+                                "UPDATE sites SET unifi_controller_url=?, unifi_username=?, unifi_password=?, is_active=?, public_access=? WHERE id=?",
+                                [$s['unifi_controller_url'], $s['unifi_username'], $s['unifi_password'], (int)$s['is_active'], (int)$s['public_access'], $exists['id']]
+                            );
+                        } else {
+                            $db->query(
+                                "INSERT INTO sites (name, site_id, unifi_controller_url, unifi_username, unifi_password, is_active, public_access) VALUES (?,?,?,?,?,?,?)",
+                                [$s['name'], $s['site_id'], $s['unifi_controller_url'], $s['unifi_username'], $s['unifi_password'], (int)$s['is_active'], (int)$s['public_access']]
+                            );
+                        }
+                        $counts['sites']++;
+                    }
+                }
+                if ($importTemplates && !empty($data['voucher_templates'])) {
+                    foreach ($data['voucher_templates'] as $t) {
+                        $exists = $db->fetchOne("SELECT id FROM voucher_templates WHERE name = ?", [$t['name']]);
+                        if (!$exists) {
+                            $db->query(
+                                "INSERT INTO voucher_templates (name, max_uses, expire_minutes, description, qos_rate_max_down, qos_rate_max_up, qos_usage_quota, is_active) VALUES (?,?,?,?,?,?,?,?)",
+                                [$t['name'], (int)$t['max_uses'], (int)$t['expire_minutes'], $t['description'] ?? null,
+                                 $t['qos_rate_max_down'] ?? null, $t['qos_rate_max_up'] ?? null, $t['qos_usage_quota'] ?? null, (int)($t['is_active'] ?? 1)]
+                            );
+                            $counts['templates']++;
+                        }
+                    }
+                }
+                $auth->writeAuditLog($_SESSION['user_id'], 'config_import', 'config', null, 'Konfiguration importiert');
+                $success = "Import abgeschlossen: {$counts['settings']} Einstellungen, {$counts['sites']} Sites, {$counts['templates']} Profile.";
+            } catch (Exception $e) {
+                $error = 'Import-Fehler: ' . $e->getMessage();
+            }
+        }
+    }
+}
+
+$csrf = $auth->getCsrfToken();
+$currentPage = 'backup';
+$adminBase   = '';
+?>
+<!DOCTYPE html>
+<html lang="<?= I18n::getLanguage() ?>">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Backup & Restore – <?= htmlspecialchars($appTitle) ?></title>
+<?php require __DIR__ . '/../includes/admin_nav.php'; ?>
+<style>
+.card { background:var(--bg-card); border:1px solid var(--border-color); border-radius:14px; padding:24px; margin-bottom:22px; box-shadow:0 4px 14px var(--shadow); max-width:680px; }
+.card h2 { font-size:16px; margin-bottom:12px; color:var(--text-primary); }
+.muted { color:var(--text-muted); font-size:13px; margin-bottom:14px; }
+.btn { padding:11px 18px; border:none; border-radius:8px; font-weight:600; cursor:pointer; font-size:14px; text-decoration:none; display:inline-block; }
+.btn-primary { background:var(--accent,#667eea); color:#fff; }
+.btn-secondary { background:var(--bg-hover); color:var(--text-primary); border:1px solid var(--border-color); }
+.alert { padding:12px 14px; border-radius:9px; font-size:14px; margin-bottom:18px; max-width:680px; }
+.alert-error { background:#fee; border:1px solid #fcc; color:#c33; }
+.alert-ok { background:#efe; border:1px solid #cfc; color:#2a7; }
+label.chk { display:flex; align-items:center; gap:9px; margin:8px 0; color:var(--text-primary); font-size:14px; }
+input[type=file] { margin:10px 0; color:var(--text-primary); }
+</style>
+</head>
+<body>
+<h1 style="font-size:24px;margin-bottom:20px;color:var(--text-primary);">💾 Backup &amp; Restore</h1>
+
+<?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+<?php if ($success): ?><div class="alert alert-ok"><?= htmlspecialchars($success) ?></div><?php endif; ?>
+
+<div class="card">
+    <h2>Export</h2>
+    <p class="muted">Lädt Einstellungen, Sites und Voucher-Profile als JSON. Site-Passwörter bleiben mit dem <code>APP_KEY</code> dieser Installation verschlüsselt – ein Restore auf einer Installation mit anderem APP_KEY kann sie nicht entschlüsseln.</p>
+    <a class="btn btn-primary" href="?export=1&token=<?= urlencode($csrf) ?>">Konfiguration exportieren</a>
+</div>
+
+<div class="card">
+    <h2>Import / Restore</h2>
+    <p class="muted">Vorhandene Sites werden anhand von Name + Site-ID aktualisiert, neue hinzugefügt. Profile werden nur angelegt, wenn der Name noch nicht existiert. Der Cron-Token wird nie überschrieben.</p>
+    <form method="post" enctype="multipart/form-data">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+        <input type="file" name="backup" accept="application/json,.json" required><br>
+        <label class="chk"><input type="checkbox" name="import_settings" checked> Einstellungen</label>
+        <label class="chk"><input type="checkbox" name="import_sites" checked> Sites</label>
+        <label class="chk"><input type="checkbox" name="import_templates" checked> Voucher-Profile</label>
+        <button class="btn btn-primary" type="submit" name="import" style="margin-top:12px;" onclick="return confirm('Import jetzt durchführen?');">Importieren</button>
+    </form>
+</div>
+
+</div><!-- /main-content -->
+<script src="../assets/global.js"></script>
+</body>
+</html>
--- a/admin/import.php
+++ b/admin/import.php
@ -0,0 +1,148 @@
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/Auth.php';
+require_once __DIR__ . '/../includes/UniFiController.php';
+require_once __DIR__ . '/../includes/Notifier.php';
+require_once __DIR__ . '/../includes/I18n.php';
+
+$auth = new Auth();
+$auth->requireAdmin();
+I18n::init();
+
+$db = Database::getInstance();
+$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
+$defaultExpire  = max(1, (int)$db->getSetting('default_expire_minutes', 480));
+$defaultMaxUses = max(1, (int)$db->getSetting('default_max_uses', 1));
+
+$error = '';
+$success = '';
+$results = [];
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['do_import'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = __('error_csrf');
+    } else {
+        try {
+            $siteId = (int)($_POST['site_id'] ?? 0);
+            $site = $db->fetchOne("SELECT * FROM sites WHERE id=? AND is_active=1", [$siteId]);
+            if (!$site) throw new Exception('Site nicht gefunden');
+
+            // CSV-Quelle: Datei bevorzugt, sonst Textarea
+            $raw = '';
+            if (!empty($_FILES['csv']['tmp_name'])) {
+                $raw = file_get_contents($_FILES['csv']['tmp_name']);
+            } else {
+                $raw = (string)($_POST['csv_text'] ?? '');
+            }
+            $lines = preg_split('/\r\n|\r|\n/', trim($raw));
+            if (count($lines) > 200) throw new Exception('Maximal 200 Zeilen pro Import.');
+
+            $controller = new UniFiController(
+                $site['unifi_controller_url'], $site['unifi_username'],
+                Crypto::decrypt($site['unifi_password']), $site['site_id']
+            );
+
+            $created = 0;
+            foreach ($lines as $i => $line) {
+                $line = trim($line);
+                if ($line === '') continue;
+                $cols = str_getcsv($line);
+                $name = trim((string)($cols[0] ?? ''));
+                if ($name === '' || strtolower($name) === 'name') continue; // Header/leer überspringen
+                $maxUses = isset($cols[1]) && $cols[1] !== '' ? max(1, (int)$cols[1]) : $defaultMaxUses;
+                $expire  = isset($cols[2]) && $cols[2] !== '' ? max(1, (int)$cols[2]) : $defaultExpire;
+                try {
+                    $v = $controller->createVoucher(date('Y-m-d') . '_' . $name, $maxUses, $expire);
+                    if (!is_array($v) || empty($v['formatted_code'])) throw new Exception('ungültige Antwort');
+                    $db->execute(
+                        "INSERT INTO vouchers (site_id, user_id, voucher_code, voucher_name, max_uses, expire_minutes, unifi_voucher_id)
+                         VALUES (?, ?, ?, ?, ?, ?, ?)",
+                        [$siteId, $_SESSION['user_id'], $v['code'], date('Y-m-d') . '_' . $name, $maxUses, $expire, $v['unifi_id'] ?? null]
+                    );
+                    $results[] = ['name' => $name, 'code' => $v['formatted_code'], 'ok' => true];
+                    $created++;
+                } catch (Exception $e) {
+                    $results[] = ['name' => $name, 'code' => $e->getMessage(), 'ok' => false];
+                }
+            }
+            if ($created > 0) {
+                Notifier::voucherCreated($created, $site['name'], $_SESSION['user_name'] ?? null);
+                $auth->writeAuditLog($_SESSION['user_id'], 'voucher_import', 'site', $siteId, "$created Voucher importiert");
+            }
+            $success = "$created Voucher erstellt.";
+        } catch (Exception $e) {
+            $error = $e->getMessage();
+        }
+    }
+}
+
+$sites = $db->fetchAll("SELECT * FROM sites WHERE is_active=1 ORDER BY name");
+$csrf = $auth->getCsrfToken();
+$currentPage = 'import';
+$adminBase   = '';
+?>
+<!DOCTYPE html>
+<html lang="<?= I18n::getLanguage() ?>">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>CSV-Import – <?= htmlspecialchars($appTitle) ?></title>
+<?php require __DIR__ . '/../includes/admin_nav.php'; ?>
+<style>
+.card { background:var(--bg-card); border:1px solid var(--border-color); border-radius:14px; padding:24px; margin-bottom:20px; box-shadow:0 4px 14px var(--shadow); max-width:760px; }
+.card h2 { font-size:15px; margin-bottom:12px; color:var(--text-primary); }
+.muted { color:var(--text-muted); font-size:13px; margin-bottom:12px; }
+label { display:block; font-size:13px; color:var(--text-secondary); margin:12px 0 6px; }
+.input,textarea,select { width:100%; padding:11px; border:2px solid var(--border-color); border-radius:8px; background:var(--bg-input,#fff); color:var(--text-primary); font-size:14px; font-family:inherit; }
+textarea { min-height:140px; font-family:monospace; }
+.btn { padding:11px 18px; border:none; border-radius:8px; font-weight:600; font-size:14px; cursor:pointer; background:var(--accent,#667eea); color:#fff; }
+.alert { padding:12px 14px; border-radius:9px; font-size:14px; margin-bottom:18px; max-width:760px; }
+.alert-error { background:#fee; border:1px solid #fcc; color:#c33; } .alert-ok { background:#efe; border:1px solid #cfc; color:#2a7; }
+table { width:100%; border-collapse:collapse; } th,td { text-align:left; padding:8px; font-size:13px; border-bottom:1px solid var(--border-color); color:var(--text-primary); }
+code { font-family:monospace; background:var(--bg-hover); padding:2px 6px; border-radius:5px; }
+</style>
+</head>
+<body>
+<h1 style="font-size:24px;margin-bottom:18px;color:var(--text-primary);">📥 Voucher-Import (CSV)</h1>
+
+<?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+<?php if ($success): ?><div class="alert alert-ok"><?= htmlspecialchars($success) ?></div><?php endif; ?>
+
+<div class="card">
+    <h2>Mehrere Voucher erstellen</h2>
+    <p class="muted">Eine Zeile pro Voucher: <code>Name,MaxGeräte,Minuten</code> – MaxGeräte und Minuten sind optional (Standardwerte greifen). Max. 200 Zeilen. Beispiel:<br>
+        <code>Gast Müller,1,480</code> · <code>Konferenzraum A,5,240</code> · <code>Tagespass</code></p>
+    <form method="post" enctype="multipart/form-data">
+        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+        <label>Standort</label>
+        <select class="input" name="site_id" required>
+            <?php foreach ($sites as $s): ?><option value="<?= (int)$s['id'] ?>"><?= htmlspecialchars($s['name']) ?></option><?php endforeach; ?>
+        </select>
+        <label>CSV-Datei (optional)</label>
+        <input class="input" type="file" name="csv" accept=".csv,text/csv">
+        <label>… oder direkt einfügen</label>
+        <textarea name="csv_text" placeholder="Gast Müller,1,480&#10;Konferenzraum A,5,240"></textarea>
+        <button class="btn" type="submit" name="do_import" style="margin-top:14px;" onclick="return confirm('Import jetzt starten?');">Importieren</button>
+    </form>
+</div>
+
+<?php if (!empty($results)): ?>
+<div class="card">
+    <h2>Ergebnis</h2>
+    <table><tr><th>Name</th><th>Code / Fehler</th><th>Status</th></tr>
+    <?php foreach ($results as $r): ?>
+        <tr><td><?= htmlspecialchars($r['name']) ?></td><td><code><?= htmlspecialchars($r['code']) ?></code></td><td><?= $r['ok'] ? '✅' : '❌' ?></td></tr>
+    <?php endforeach; ?>
+    </table>
+</div>
+<?php endif; ?>
+
+</div><!-- /main-content -->
+<script src="../assets/global.js"></script>
+</body>
+</html>
--- a/admin/integrations.php
+++ b/admin/integrations.php
@ -0,0 +1,204 @@
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/Auth.php';
+require_once __DIR__ . '/../includes/Notifier.php';
+require_once __DIR__ . '/../includes/I18n.php';
+
+$auth = new Auth();
+$auth->requireAdmin();
+I18n::init();
+
+$db = Database::getInstance();
+$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
+
+$error = '';
+$success = '';
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['save'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = __('error_csrf');
+    } else {
+        $db->setSetting('enforce_2fa_admins',   isset($_POST['enforce_2fa_admins']) ? '1' : '0');
+        $db->setSetting('session_driver',       ($_POST['session_driver'] ?? 'php') === 'db' ? 'db' : 'php');
+        $cm = in_array($_POST['captcha_mode'] ?? 'off', ['off','math','hcaptcha'], true) ? $_POST['captcha_mode'] : 'off';
+        $db->setSetting('captcha_mode',         $cm);
+        $db->setSetting('captcha_site_key',     trim($_POST['captcha_site_key'] ?? ''));
+        if (!empty($_POST['captcha_secret'])) { $db->setSetting('captcha_secret', trim($_POST['captcha_secret'])); }
+        $db->setSetting('sms_enabled',  isset($_POST['sms_enabled']) ? '1' : '0');
+        $db->setSetting('twilio_sid',   trim($_POST['twilio_sid'] ?? ''));
+        $db->setSetting('twilio_from',  trim($_POST['twilio_from'] ?? ''));
+        if (!empty($_POST['twilio_token'])) { $db->setSetting('twilio_token', trim($_POST['twilio_token'])); }
+        $db->setSetting('oidc_enabled',      isset($_POST['oidc_enabled']) ? '1' : '0');
+        $db->setSetting('oidc_name',         trim($_POST['oidc_name'] ?? 'SSO'));
+        $db->setSetting('oidc_client_id',    trim($_POST['oidc_client_id'] ?? ''));
+        $db->setSetting('oidc_auth_url',     trim($_POST['oidc_auth_url'] ?? ''));
+        $db->setSetting('oidc_token_url',    trim($_POST['oidc_token_url'] ?? ''));
+        $db->setSetting('oidc_userinfo_url', trim($_POST['oidc_userinfo_url'] ?? ''));
+        $db->setSetting('oidc_scopes',       trim($_POST['oidc_scopes'] ?? 'openid profile email'));
+        if (!empty($_POST['oidc_client_secret'])) { $db->setSetting('oidc_client_secret', trim($_POST['oidc_client_secret'])); }
+        $db->setSetting('user_daily_voucher_limit', max(0, (int)($_POST['user_daily_voucher_limit'] ?? 0)));
+        $db->setSetting('trusted_proxy',        trim($_POST['trusted_proxy'] ?? ''));
+        $db->setSetting('webhook_enabled',      isset($_POST['webhook_enabled']) ? '1' : '0');
+        $db->setSetting('webhook_url',          trim($_POST['webhook_url'] ?? ''));
+        $db->setSetting('cleanup_expired_days', max(0, (int)($_POST['cleanup_expired_days'] ?? 0)));
+        $db->setSetting('cleanup_audit_days',   max(0, (int)($_POST['cleanup_audit_days'] ?? 0)));
+        $db->setSetting('cleanup_login_days',   max(0, (int)($_POST['cleanup_login_days'] ?? 30)));
+        $auth->writeAuditLog($_SESSION['user_id'], 'settings_update', 'config', null, 'Integration/Wartung gespeichert');
+        $success = 'Einstellungen gespeichert.';
+    }
+}
+
+if (isset($_GET['test_webhook']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) {
+    Notifier::send('✅ Test-Benachrichtigung vom UniFi Voucher System.', ['type' => 'test']);
+    $success = 'Test-Benachrichtigung gesendet (sofern Webhook aktiv & URL gültig).';
+}
+
+$enforce2fa        = $db->getSetting('enforce_2fa_admins', '0') === '1';
+$sessionDriver     = $db->getSetting('session_driver', 'php');
+$captchaMode       = $db->getSetting('captcha_mode', 'off');
+$captchaSiteKey    = $db->getSetting('captcha_site_key', '');
+$captchaSecretSet  = $db->getSetting('captcha_secret', '') !== '';
+$smsEnabled        = $db->getSetting('sms_enabled', '0') === '1';
+$twilioSid         = $db->getSetting('twilio_sid', '');
+$twilioFrom        = $db->getSetting('twilio_from', '');
+$twilioTokenSet    = $db->getSetting('twilio_token', '') !== '';
+$oidcEnabled       = $db->getSetting('oidc_enabled', '0') === '1';
+$oidcName          = $db->getSetting('oidc_name', 'SSO');
+$oidcClientId      = $db->getSetting('oidc_client_id', '');
+$oidcAuthUrl       = $db->getSetting('oidc_auth_url', '');
+$oidcTokenUrl      = $db->getSetting('oidc_token_url', '');
+$oidcUserinfoUrl   = $db->getSetting('oidc_userinfo_url', '');
+$oidcScopes        = $db->getSetting('oidc_scopes', 'openid profile email');
+$oidcSecretSet     = $db->getSetting('oidc_client_secret', '') !== '';
+$dailyLimit        = (int)$db->getSetting('user_daily_voucher_limit', 0);
+$trustedProxy      = $db->getSetting('trusted_proxy', '');
+$webhookEnabled    = $db->getSetting('webhook_enabled', '0') === '1';
+$webhookUrl        = $db->getSetting('webhook_url', '');
+$cleanupExpired    = (int)$db->getSetting('cleanup_expired_days', 0);
+$cleanupAudit      = (int)$db->getSetting('cleanup_audit_days', 0);
+$cleanupLogin      = (int)$db->getSetting('cleanup_login_days', 30);
+$lastCleanup       = $db->getSetting('last_cleanup', '');
+$csrf = $auth->getCsrfToken();
+$currentPage = 'integrations';
+$adminBase   = '';
+?>
+<!DOCTYPE html>
+<html lang="<?= I18n::getLanguage() ?>">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Integration & Wartung – <?= htmlspecialchars($appTitle) ?></title>
+<?php require __DIR__ . '/../includes/admin_nav.php'; ?>
+<style>
+.card { background:var(--bg-card); border:1px solid var(--border-color); border-radius:14px; padding:24px; margin-bottom:22px; box-shadow:0 4px 14px var(--shadow); max-width:680px; }
+.card h2 { font-size:16px; margin-bottom:6px; color:var(--text-primary); }
+.muted { color:var(--text-muted); font-size:13px; margin-bottom:14px; }
+label { display:block; font-size:14px; color:var(--text-secondary); margin:14px 0 6px; }
+.input { width:100%; padding:11px; border:2px solid var(--border-color); border-radius:8px; background:var(--bg-input,#fff); color:var(--text-primary); font-size:14px; }
+.row { display:grid; grid-template-columns:1fr 1fr 1fr; gap:12px; }
+.chk { display:flex; align-items:center; gap:9px; margin-top:14px; color:var(--text-primary); font-size:14px; }
+.btn { padding:11px 18px; border:none; border-radius:8px; font-weight:600; cursor:pointer; font-size:14px; text-decoration:none; display:inline-block; }
+.btn-primary { background:var(--accent,#667eea); color:#fff; } .btn-secondary { background:var(--bg-hover); color:var(--text-primary); border:1px solid var(--border-color); }
+.alert { padding:12px 14px; border-radius:9px; font-size:14px; margin-bottom:18px; max-width:680px; }
+.alert-error { background:#fee; border:1px solid #fcc; color:#c33; } .alert-ok { background:#efe; border:1px solid #cfc; color:#2a7; }
+</style>
+</head>
+<body>
+<h1 style="font-size:24px;margin-bottom:20px;color:var(--text-primary);">🔧 Integration &amp; Wartung</h1>
+
+<?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+<?php if ($success): ?><div class="alert alert-ok"><?= htmlspecialchars($success) ?></div><?php endif; ?>
+
+<form method="post">
+<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+
+<div class="card">
+    <h2>Sicherheitsrichtlinie</h2>
+    <p class="muted">Erzwingt Zwei-Faktor-Authentifizierung für alle Administrator-Konten (lokale Accounts). Admins ohne 2FA werden bei der nächsten Aktion zur Einrichtung geleitet.</p>
+    <label class="chk"><input type="checkbox" name="enforce_2fa_admins" <?= $enforce2fa ? 'checked' : '' ?>> 2FA für Administratoren verpflichtend</label>
+    <label>Tageslimit Voucher pro Nicht-Admin-Benutzer (0 = unbegrenzt)</label>
+    <input class="input" type="number" min="0" name="user_daily_voucher_limit" value="<?= $dailyLimit ?>" style="max-width:200px;">
+    <label>Session-Speicher</label>
+    <select class="input" name="session_driver" style="max-width:240px;">
+        <option value="php" <?= $sessionDriver==='php'?'selected':'' ?>>PHP-Standard (Dateien)</option>
+        <option value="db"  <?= $sessionDriver==='db'?'selected':'' ?>>Datenbank (ermöglicht „überall abmelden")</option>
+    </select>
+    <label>Captcha im öffentlichen Modus</label>
+    <select class="input" name="captcha_mode" style="max-width:240px;">
+        <option value="off"      <?= $captchaMode==='off'?'selected':'' ?>>Aus</option>
+        <option value="math"     <?= $captchaMode==='math'?'selected':'' ?>>Rechenaufgabe (ohne externen Dienst)</option>
+        <option value="hcaptcha" <?= $captchaMode==='hcaptcha'?'selected':'' ?>>hCaptcha</option>
+    </select>
+    <div class="row3" style="margin-top:10px;">
+        <div><label>hCaptcha Site-Key</label><input class="input" type="text" name="captcha_site_key" value="<?= htmlspecialchars($captchaSiteKey) ?>"></div>
+        <div><label>hCaptcha Secret<?= $captchaSecretSet ? ' (gesetzt)' : '' ?></label><input class="input" type="password" name="captcha_secret" placeholder="<?= $captchaSecretSet ? '••••••• (leer = unverändert)' : '' ?>"></div>
+    </div>
+</div>
+
+<div class="card">
+    <h2>Reverse-Proxy</h2>
+    <p class="muted">IP-Adressen vertrauenswürdiger Proxies (kommasepariert). Nur dann wird die echte Client-IP aus <code>X-Forwarded-For</code> für Rate-Limit & Audit verwendet.</p>
+    <input class="input" type="text" name="trusted_proxy" value="<?= htmlspecialchars($trustedProxy) ?>" placeholder="z.B. 10.0.0.1, 172.18.0.1">
+</div>
+
+<div class="card">
+    <h2>Webhook-Benachrichtigungen</h2>
+    <p class="muted">Slack-, Microsoft-Teams- oder generische JSON-Webhook-URL. Wird bei Voucher-Erstellung ausgelöst.</p>
+    <label class="chk"><input type="checkbox" name="webhook_enabled" <?= $webhookEnabled ? 'checked' : '' ?>> Webhook aktiv</label>
+    <label>Webhook-URL</label>
+    <input class="input" type="url" name="webhook_url" value="<?= htmlspecialchars($webhookUrl) ?>" placeholder="https://hooks.slack.com/services/…">
+    <div style="margin-top:12px;">
+        <a class="btn btn-secondary" href="?test_webhook=1&token=<?= urlencode($csrf) ?>">Test senden</a>
+    </div>
+</div>
+
+<div class="card">
+    <h2>SMS-Versand (Twilio)</h2>
+    <p class="muted">Voucher-Codes optional per SMS versenden. Erfordert ein Twilio-Konto.</p>
+    <label class="chk"><input type="checkbox" name="sms_enabled" <?= $smsEnabled ? 'checked' : '' ?>> SMS-Versand aktiv</label>
+    <div class="row3" style="margin-top:10px;">
+        <div><label>Account SID</label><input class="input" type="text" name="twilio_sid" value="<?= htmlspecialchars($twilioSid) ?>"></div>
+        <div><label>Auth Token<?= $twilioTokenSet ? ' (gesetzt)' : '' ?></label><input class="input" type="password" name="twilio_token" placeholder="<?= $twilioTokenSet ? '••••••• (leer = unverändert)' : '' ?>"></div>
+        <div><label>Absender (From)</label><input class="input" type="text" name="twilio_from" value="<?= htmlspecialchars($twilioFrom) ?>" placeholder="+49…"></div>
+    </div>
+</div>
+
+<div class="card">
+    <h2>Single Sign-On (OpenID Connect)</h2>
+    <p class="muted">Generischer OIDC-Provider (z.B. Keycloak, Authentik, Google, Auth0). Redirect-URI: <code><?= htmlspecialchars(((!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?'https':'http').'://'.$_SERVER['HTTP_HOST'].rtrim(dirname($_SERVER['SCRIPT_NAME']),'/').'/../oidc_callback.php') ?></code></p>
+    <label class="chk"><input type="checkbox" name="oidc_enabled" <?= $oidcEnabled ? 'checked' : '' ?>> OIDC-Login aktiv</label>
+    <div class="row3" style="margin-top:10px;">
+        <div><label>Button-Text</label><input class="input" type="text" name="oidc_name" value="<?= htmlspecialchars($oidcName) ?>"></div>
+        <div><label>Client ID</label><input class="input" type="text" name="oidc_client_id" value="<?= htmlspecialchars($oidcClientId) ?>"></div>
+        <div><label>Client Secret<?= $oidcSecretSet ? ' (gesetzt)' : '' ?></label><input class="input" type="password" name="oidc_client_secret" placeholder="<?= $oidcSecretSet ? '••••••• (leer = unverändert)' : '' ?>"></div>
+    </div>
+    <label>Authorization Endpoint</label><input class="input" type="url" name="oidc_auth_url" value="<?= htmlspecialchars($oidcAuthUrl) ?>" placeholder="https://idp/authorize">
+    <label>Token Endpoint</label><input class="input" type="url" name="oidc_token_url" value="<?= htmlspecialchars($oidcTokenUrl) ?>" placeholder="https://idp/token">
+    <label>Userinfo Endpoint</label><input class="input" type="url" name="oidc_userinfo_url" value="<?= htmlspecialchars($oidcUserinfoUrl) ?>" placeholder="https://idp/userinfo">
+    <label>Scopes</label><input class="input" type="text" name="oidc_scopes" value="<?= htmlspecialchars($oidcScopes) ?>">
+</div>
+
+<div class="card">
+    <h2>Datenhaltung & Cleanup (DSGVO)</h2>
+    <p class="muted">Aufbewahrungsfristen in Tagen (0 = deaktiviert). Ausführung per <code>cron_cleanup.php</code> (täglich empfohlen).
+        <?php if ($lastCleanup): ?><br>Letzter Lauf: <?= htmlspecialchars($lastCleanup) ?><?php endif; ?>
+    </p>
+    <div class="row">
+        <div><label>Abgelaufene Voucher</label><input class="input" type="number" min="0" name="cleanup_expired_days" value="<?= $cleanupExpired ?>"></div>
+        <div><label>Audit-Log</label><input class="input" type="number" min="0" name="cleanup_audit_days" value="<?= $cleanupAudit ?>"></div>
+        <div><label>Login-Versuche</label><input class="input" type="number" min="0" name="cleanup_login_days" value="<?= $cleanupLogin ?>"></div>
+    </div>
+</div>
+
+<button class="btn btn-primary" type="submit" name="save">Speichern</button>
+</form>
+
+</div><!-- /main-content -->
+<script src="../assets/global.js"></script>
+</body>
+</html>
--- a/admin/reports.php
+++ b/admin/reports.php
@ -0,0 +1,174 @@
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/Auth.php';
+require_once __DIR__ . '/../includes/I18n.php';
+
+$auth = new Auth();
+$auth->requireAdmin();
+I18n::init();
+
+$db = Database::getInstance();
+$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
+
+// Zeitraum (Tage)
+$days = max(1, min(365, (int)($_GET['days'] ?? 30)));
+
+// CSV-Export
+if (isset($_GET['export'])) {
+    $auth->requireAdmin();
+    header('Content-Type: text/csv; charset=utf-8');
+    $fn = 'report-' . $_GET['export'] . '-' . date('Y-m-d') . '.csv';
+    header('Content-Disposition: attachment; filename="' . $fn . '"');
+    $out = fopen('php://output', 'w');
+    fprintf($out, "\xEF\xBB\xBF"); // UTF-8 BOM für Excel
+
+    if ($_GET['export'] === 'per_site') {
+        fputcsv($out, ['Site', 'Gesamt', 'Gültig', 'Verwendet', 'Abgelaufen']);
+        $rows = $db->fetchAll(
+            "SELECT s.name,
+                COUNT(v.id) total,
+                SUM(v.status='valid') valid,
+                SUM(v.status='used') used,
+                SUM(v.status='expired') expired
+             FROM sites s LEFT JOIN vouchers v ON v.site_id=s.id
+             GROUP BY s.id ORDER BY total DESC"
+        );
+        foreach ($rows as $r) fputcsv($out, [$r['name'], (int)$r['total'], (int)$r['valid'], (int)$r['used'], (int)$r['expired']]);
+    } elseif ($_GET['export'] === 'per_user') {
+        fputcsv($out, ['Benutzer', 'E-Mail', 'Voucher erstellt']);
+        $rows = $db->fetchAll(
+            "SELECT u.name, u.email, COUNT(v.id) c FROM users u
+             LEFT JOIN vouchers v ON v.user_id=u.id GROUP BY u.id ORDER BY c DESC"
+        );
+        foreach ($rows as $r) fputcsv($out, [$r['name'], $r['email'], (int)$r['c']]);
+    } else { // daily
+        fputcsv($out, ['Datum', 'Erstellte Voucher']);
+        $rows = $db->fetchAll(
+            "SELECT DATE(created_at) d, COUNT(*) c FROM vouchers
+             WHERE created_at >= DATE_SUB(CURDATE(), INTERVAL ? DAY)
+             GROUP BY DATE(created_at) ORDER BY d", [$days]
+        );
+        foreach ($rows as $r) fputcsv($out, [$r['d'], (int)$r['c']]);
+    }
+    fclose($out);
+    exit;
+}
+
+// Kennzahlen
+$totals = $db->fetchOne(
+    "SELECT COUNT(*) total,
+        SUM(status='valid') valid, SUM(status='used') used, SUM(status='expired') expired
+     FROM vouchers"
+);
+$inPeriod = (int)($db->fetchOne(
+    "SELECT COUNT(*) c FROM vouchers WHERE created_at >= DATE_SUB(CURDATE(), INTERVAL ? DAY)", [$days]
+)['c'] ?? 0);
+
+$perSite = $db->fetchAll(
+    "SELECT s.name,
+        COUNT(v.id) total, SUM(v.status='valid') valid, SUM(v.status='used') used, SUM(v.status='expired') expired
+     FROM sites s LEFT JOIN vouchers v ON v.site_id=s.id GROUP BY s.id ORDER BY total DESC"
+);
+$perUser = $db->fetchAll(
+    "SELECT u.name, COUNT(v.id) c FROM users u LEFT JOIN vouchers v ON v.user_id=u.id
+     GROUP BY u.id HAVING c > 0 ORDER BY c DESC LIMIT 10"
+);
+$daily = $db->fetchAll(
+    "SELECT DATE(created_at) d, COUNT(*) c FROM vouchers
+     WHERE created_at >= DATE_SUB(CURDATE(), INTERVAL ? DAY)
+     GROUP BY DATE(created_at) ORDER BY d", [$days]
+);
+$chartLabels = array_map(fn($r) => date('d.m', strtotime($r['d'])), $daily);
+$chartData   = array_map(fn($r) => (int)$r['c'], $daily);
+
+$csrf = $auth->getCsrfToken();
+$currentPage = 'reports';
+$adminBase   = '';
+?>
+<!DOCTYPE html>
+<html lang="<?= I18n::getLanguage() ?>">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Reporting – <?= htmlspecialchars($appTitle) ?></title>
+<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js"></script>
+<?php require __DIR__ . '/../includes/admin_nav.php'; ?>
+<style>
+.card { background:var(--bg-card); border:1px solid var(--border-color); border-radius:14px; padding:22px; margin-bottom:20px; box-shadow:0 4px 14px var(--shadow); }
+.card h2 { font-size:15px; margin-bottom:14px; color:var(--text-primary); }
+.grid4 { display:grid; grid-template-columns:repeat(4,1fr); gap:16px; margin-bottom:20px; }
+.stat { background:var(--bg-card); border:1px solid var(--border-color); border-radius:14px; padding:20px; }
+.stat .n { font-size:28px; font-weight:700; color:var(--text-primary); } .stat .l { color:var(--text-muted); font-size:12.5px; margin-top:3px; }
+table { width:100%; border-collapse:collapse; } th,td { text-align:left; padding:10px 8px; font-size:14px; border-bottom:1px solid var(--border-color); color:var(--text-primary); } th { color:var(--text-muted); }
+.btn { padding:9px 15px; border:none; border-radius:8px; font-weight:600; font-size:13px; text-decoration:none; display:inline-block; cursor:pointer; }
+.btn-s { background:var(--bg-hover); color:var(--text-primary); border:1px solid var(--border-color); }
+.toolbar { display:flex; gap:10px; align-items:center; flex-wrap:wrap; margin-bottom:18px; }
+select.input { padding:9px; border:2px solid var(--border-color); border-radius:8px; background:var(--bg-input,#fff); color:var(--text-primary); }
+@media print { .sidebar,.header,.toolbar,.no-print { display:none !important; } .main-content { margin:0 !important; } }
+</style>
+</head>
+<body>
+<h1 style="font-size:24px;margin-bottom:18px;color:var(--text-primary);">📊 Reporting</h1>
+
+<div class="toolbar no-print">
+    <form method="get" style="display:flex;gap:8px;align-items:center;">
+        <label style="color:var(--text-muted);font-size:13px;">Zeitraum:</label>
+        <select class="input" name="days" onchange="this.form.submit()">
+            <?php foreach ([7,30,90,365] as $d): ?>
+            <option value="<?= $d ?>" <?= $days===$d?'selected':'' ?>><?= $d ?> Tage</option>
+            <?php endforeach; ?>
+        </select>
+    </form>
+    <a class="btn btn-s" href="?export=daily&days=<?= $days ?>">⬇️ CSV (täglich)</a>
+    <a class="btn btn-s" href="?export=per_site">⬇️ CSV (pro Site)</a>
+    <a class="btn btn-s" href="?export=per_user">⬇️ CSV (pro Nutzer)</a>
+    <button class="btn btn-s" onclick="window.print()">🖨️ Drucken/PDF</button>
+</div>
+
+<div class="grid4">
+    <div class="stat"><div class="n"><?= (int)$totals['total'] ?></div><div class="l">Vouchers gesamt</div></div>
+    <div class="stat"><div class="n"><?= (int)$totals['valid'] ?></div><div class="l">Gültig</div></div>
+    <div class="stat"><div class="n"><?= (int)$totals['used'] ?></div><div class="l">Verwendet</div></div>
+    <div class="stat"><div class="n"><?= $inPeriod ?></div><div class="l">In <?= $days ?> Tagen erstellt</div></div>
+</div>
+
+<div class="card">
+    <h2>Erstellte Voucher (<?= $days ?> Tage)</h2>
+    <canvas id="chart" height="90"></canvas>
+</div>
+
+<div class="card">
+    <h2>Pro Site</h2>
+    <table><tr><th>Site</th><th>Gesamt</th><th>Gültig</th><th>Verwendet</th><th>Abgelaufen</th></tr>
+    <?php foreach ($perSite as $r): ?>
+        <tr><td><?= htmlspecialchars($r['name']) ?></td><td><?= (int)$r['total'] ?></td><td><?= (int)$r['valid'] ?></td><td><?= (int)$r['used'] ?></td><td><?= (int)$r['expired'] ?></td></tr>
+    <?php endforeach; ?>
+    </table>
+</div>
+
+<div class="card">
+    <h2>Top-Nutzer</h2>
+    <table><tr><th>Benutzer</th><th>Voucher erstellt</th></tr>
+    <?php foreach ($perUser as $r): ?>
+        <tr><td><?= htmlspecialchars($r['name'] ?? '–') ?></td><td><?= (int)$r['c'] ?></td></tr>
+    <?php endforeach; ?>
+    <?php if (empty($perUser)): ?><tr><td colspan="2" style="color:var(--text-muted);">Keine Daten</td></tr><?php endif; ?>
+    </table>
+</div>
+
+</div><!-- /main-content -->
+<script src="../assets/global.js"></script>
+<script>
+new Chart(document.getElementById('chart'), {
+  type:'line',
+  data:{ labels: <?= json_encode($chartLabels) ?>, datasets:[{ label:'Voucher', data: <?= json_encode($chartData) ?>, borderColor:'#667eea', backgroundColor:'rgba(102,126,234,.15)', fill:true, tension:.3 }] },
+  options:{ plugins:{legend:{display:false}}, scales:{y:{beginAtZero:true,ticks:{precision:0}}} }
+});
+</script>
+</body>
+</html>
--- a/admin/security.php
+++ b/admin/security.php
@ -0,0 +1,194 @@
+<?php
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/Auth.php';
+
+$auth = new Auth();
+$auth->requireLogin();
+
+$db   = Database::getInstance();
+$user = $auth->getCurrentUser();
+$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
+
+$error = '';
+$success = '';
+$backupCodes = [];           // nur direkt nach Erzeugung gefüllt
+$hasPassword = !empty($user['password_hash']);
+$totpEnabled = !empty($user['totp_enabled']);
+$setupRequired = isset($_GET['setup_required']);
+
+// 2FA aktivieren (Code bestaetigen)
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['enable_totp'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = 'Ungültiges Sicherheits-Token';
+    } else {
+        $secret = $_SESSION['totp_setup_secret'] ?? '';
+        $code   = trim($_POST['code'] ?? '');
+        if ($secret === '') {
+            $error = 'Setup abgelaufen, bitte erneut starten.';
+        } elseif (!Totp::verify($secret, $code)) {
+            $error = 'Code ungültig. Bitte erneut versuchen.';
+        } else {
+            $backupCodes = $auth->enableTotp($user['id'], $secret);
+            unset($_SESSION['totp_setup_secret']);
+            $totpEnabled = true;
+            $user = $auth->getCurrentUser();
+            $success = 'Zwei-Faktor-Authentifizierung wurde aktiviert. Bitte Recovery-Codes sicher speichern!';
+        }
+    }
+}
+
+// Überall abmelden (andere Sessions beenden)
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['logout_others'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = 'Ungültiges Sicherheits-Token';
+    } else {
+        $auth->logoutOtherSessions();
+        $success = 'Alle anderen Sitzungen wurden beendet.';
+    }
+}
+
+// Recovery-Codes neu erzeugen
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['regen_codes'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = 'Ungültiges Sicherheits-Token';
+    } elseif (!empty($user['totp_enabled'])) {
+        $backupCodes = $auth->regenerateBackupCodes($user['id']);
+        $user = $auth->getCurrentUser();
+        $success = 'Neue Recovery-Codes erzeugt. Die alten sind jetzt ungültig.';
+    }
+}
+
+// 2FA deaktivieren
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['disable_totp'])) {
+    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
+        $error = 'Ungültiges Sicherheits-Token';
+    } else {
+        $auth->disableTotp($user['id']);
+        $totpEnabled = false;
+        $success = 'Zwei-Faktor-Authentifizierung wurde deaktiviert.';
+    }
+}
+
+// Für die Setup-Ansicht ein Secret erzeugen (in Session halten bis bestätigt)
+$setupSecret = '';
+$otpUri = '';
+if (!$totpEnabled && $hasPassword) {
+    $setupSecret = $_SESSION['totp_setup_secret'] ?? Totp::generateSecret();
+    $_SESSION['totp_setup_secret'] = $setupSecret;
+    $otpUri = Totp::provisioningUri($setupSecret, $user['email'], $appTitle);
+}
+$csrf = $auth->getCsrfToken();
+$dbSessions = $db->getSetting('session_driver', 'php') === 'db';
+$activeSessions = $dbSessions ? $auth->activeSessionCount() : 0;
+?>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Zwei-Faktor-Authentifizierung – <?= htmlspecialchars($appTitle) ?></title>
+<?php if (!$totpEnabled && $hasPassword): ?>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js" integrity="sha512-CNgIRecGo7nphbeZ04Sc13ka07paqdeTu0WR1IM4kNcpmBAUSHSe2keRB6Q5pBUtIxCY7bQMsVB0ANBpd6JDg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+<?php endif; ?>
+<style>
+* { margin:0; padding:0; box-sizing:border-box; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif; }
+body { background:linear-gradient(135deg,#667eea 0%,#764ba2 100%); min-height:100vh; display:flex; align-items:center; justify-content:center; padding:20px; }
+.card { background:#fff; border-radius:18px; box-shadow:0 20px 60px rgba(0,0,0,.3); max-width:480px; width:100%; padding:36px; }
+h1 { font-size:22px; color:#333; margin-bottom:6px; }
+.sub { color:#777; font-size:14px; margin-bottom:24px; }
+.alert { padding:12px 14px; border-radius:9px; font-size:14px; margin-bottom:18px; }
+.alert-error { background:#fee; border:1px solid #fcc; color:#c33; }
+.alert-ok { background:#efe; border:1px solid #cfc; color:#2a7; }
+.status { display:inline-flex; align-items:center; gap:8px; padding:6px 12px; border-radius:8px; font-size:13px; font-weight:600; margin-bottom:20px; }
+.on { background:#e3f6ea; color:#2a7; } .off { background:#fdeaea; color:#c33; }
+.qr { display:flex; justify-content:center; margin:18px 0; }
+.secret { font-family:monospace; background:#f5f6fa; padding:10px; border-radius:8px; text-align:center; letter-spacing:2px; word-break:break-all; font-size:14px; margin-bottom:18px; }
+ol { margin:0 0 18px 18px; color:#555; font-size:14px; line-height:1.7; }
+label { display:block; font-size:14px; color:#555; margin-bottom:8px; font-weight:500; }
+input[type=text] { width:100%; padding:13px; border:2px solid #e0e0e0; border-radius:10px; font-size:18px; letter-spacing:6px; text-align:center; }
+.btn { width:100%; padding:14px; border:none; border-radius:10px; font-size:15px; font-weight:600; cursor:pointer; margin-top:14px; }
+.btn-primary { background:#667eea; color:#fff; } .btn-danger { background:#e25555; color:#fff; }
+.back { display:block; text-align:center; margin-top:20px; color:#667eea; text-decoration:none; font-size:14px; }
+.codes-box { background:#fff8e6; border:1px solid #ffe3a3; border-radius:10px; padding:16px; margin-bottom:18px; }
+.codes-box strong { font-size:15px; } .codes-box p { color:#8a6d2f; font-size:13px; margin:6px 0 12px; }
+.codes { display:grid; grid-template-columns:1fr 1fr; gap:8px; }
+.codes span { font-family:monospace; background:#fff; border:1px solid #ffe3a3; border-radius:6px; padding:8px; text-align:center; letter-spacing:2px; font-size:14px; }
+</style>
+</head>
+<body>
+<div class="card">
+  <h1>🔐 Zwei-Faktor-Authentifizierung</h1>
+  <p class="sub">Konto: <?= htmlspecialchars($user['email']) ?></p>
+
+  <?php if ($setupRequired && !$totpEnabled): ?>
+    <div class="alert alert-error">Aus Sicherheitsgründen ist 2FA für Administratoren verpflichtend. Bitte jetzt einrichten.</div>
+  <?php endif; ?>
+  <?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+  <?php if ($success): ?><div class="alert alert-ok"><?= htmlspecialchars($success) ?></div><?php endif; ?>
+
+  <?php if (!empty($backupCodes)): ?>
+    <div class="codes-box">
+      <strong>🔑 Recovery-Codes</strong>
+      <p>Bewahren Sie diese sicher auf. Jeder Code funktioniert <em>einmal</em>, falls Sie keinen Zugriff auf Ihre App haben.</p>
+      <div class="codes">
+        <?php foreach ($backupCodes as $c): ?><span><?= htmlspecialchars($c) ?></span><?php endforeach; ?>
+      </div>
+    </div>
+  <?php endif; ?>
+
+  <?php if (!$hasPassword): ?>
+    <div class="status off">● Nicht verfügbar</div>
+    <p class="sub">Ihr Konto meldet sich über Microsoft 365 an. 2FA wird dort in Ihrem Microsoft-Konto verwaltet.</p>
+  <?php elseif ($totpEnabled): ?>
+    <div class="status on">● Aktiv</div>
+    <p class="sub">Bei jeder Anmeldung wird zusätzlich ein Code aus Ihrer Authenticator-App abgefragt.<br>
+       Verbleibende Recovery-Codes: <strong><?= (int)$auth->backupCodesRemaining($user) ?></strong></p>
+    <form method="post" style="margin-bottom:10px;">
+      <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+      <button type="submit" name="regen_codes" class="btn btn-secondary" style="background:#eef0ff;color:#5a63d6;width:100%;">Recovery-Codes neu erzeugen</button>
+    </form>
+    <form method="post" onsubmit="return confirm('2FA wirklich deaktivieren?');">
+      <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+      <button type="submit" name="disable_totp" class="btn btn-danger">2FA deaktivieren</button>
+    </form>
+  <?php else: ?>
+    <div class="status off">● Inaktiv</div>
+    <ol>
+      <li>Authenticator-App öffnen (Google Authenticator, Authy, Microsoft Authenticator …)</li>
+      <li>QR-Code scannen <em>oder</em> Secret manuell eingeben</li>
+      <li>Den angezeigten 6-stelligen Code unten eingeben</li>
+    </ol>
+    <div class="qr"><div id="qrcode"></div></div>
+    <div class="secret"><?= htmlspecialchars($setupSecret) ?></div>
+    <form method="post">
+      <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+      <label for="code">6-stelliger Code</label>
+      <input type="text" id="code" name="code" inputmode="numeric" pattern="[0-9]*" maxlength="6" autocomplete="one-time-code" required>
+      <button type="submit" name="enable_totp" class="btn btn-primary">2FA aktivieren</button>
+    </form>
+    <script>
+      new QRCode(document.getElementById('qrcode'), {
+        text: <?= json_encode($otpUri) ?>, width: 180, height: 180,
+        correctLevel: QRCode.CorrectLevel.M
+      });
+    </script>
+  <?php endif; ?>
+
+  <?php if ($dbSessions): ?>
+  <hr style="margin:20px 0;border:none;border-top:1px solid #eee;">
+  <p class="sub">Aktive Sitzungen: <strong><?= (int)$activeSessions ?></strong></p>
+  <form method="post" onsubmit="return confirm('Alle anderen Sitzungen abmelden?');">
+    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">
+    <button type="submit" name="logout_others" class="btn" style="background:#eef0ff;color:#5a63d6;width:100%;">Auf allen anderen Geräten abmelden</button>
+  </form>
+  <?php endif; ?>
+
+  <a class="back" href="../index.php">← Zurück</a>
+</div>
+</body>
+</html>
--- a/admin/templates.php
+++ b/admin/templates.php
@ -29,13 +29,17 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['add_template'])) {
            $expireMin   = (int)($_POST['expire_minutes'] ?? 480);
            $description = trim($_POST['description'] ?? '');

+            $qosDown  = max(0, (int)($_POST['qos_rate_max_down'] ?? 0)) ?: null;
+            $qosUp    = max(0, (int)($_POST['qos_rate_max_up'] ?? 0)) ?: null;
+            $qosQuota = max(0, (int)($_POST['qos_usage_quota'] ?? 0)) ?: null;
+
            if (empty($name)) throw new Exception(__('error_name_req'));
            if ($maxUses < 1)  $maxUses = 1;
            if ($expireMin < 1) $expireMin = 60;

            $db->execute(
-                "INSERT INTO voucher_templates (name, max_uses, expire_minutes, description, created_by) VALUES (?, ?, ?, ?, ?)",
-                [$name, $maxUses, $expireMin, $description, $_SESSION['user_id']]
+                "INSERT INTO voucher_templates (name, max_uses, expire_minutes, description, qos_rate_max_down, qos_rate_max_up, qos_usage_quota, created_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+                [$name, $maxUses, $expireMin, $description, $qosDown, $qosUp, $qosQuota, $_SESSION['user_id']]
            );
            $success = __('templates_added');
        } catch (Exception $e) {
@ -57,11 +61,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['edit_template'])) {
            $description = trim($_POST['description'] ?? '');
            $isActive    = isset($_POST['is_active']) ? 1 : 0;

+            $qosDown  = max(0, (int)($_POST['qos_rate_max_down'] ?? 0)) ?: null;
+            $qosUp    = max(0, (int)($_POST['qos_rate_max_up'] ?? 0)) ?: null;
+            $qosQuota = max(0, (int)($_POST['qos_usage_quota'] ?? 0)) ?: null;
+
            if (empty($name)) throw new Exception(__('error_name_req'));

            $db->execute(
-                "UPDATE voucher_templates SET name=?, max_uses=?, expire_minutes=?, description=?, is_active=? WHERE id=?",
-                [$name, $maxUses, $expireMin, $description, $isActive, $id]
+                "UPDATE voucher_templates SET name=?, max_uses=?, expire_minutes=?, description=?, qos_rate_max_down=?, qos_rate_max_up=?, qos_usage_quota=?, is_active=? WHERE id=?",
+                [$name, $maxUses, $expireMin, $description, $qosDown, $qosUp, $qosQuota, $isActive, $id]
            );
            $success = __('templates_updated');
        } catch (Exception $e) {
@ -204,7 +212,7 @@ $adminBase   = '';
                                <?php endif; ?>
                            </td>
                            <td>
-                                <button onclick="openEditModal(<?= $t['id'] ?>, '<?= htmlspecialchars($t['name'], ENT_QUOTES) ?>', <?= (int)$t['max_uses'] ?>, <?= (int)$t['expire_minutes'] ?>, '<?= htmlspecialchars($t['description'] ?? '', ENT_QUOTES) ?>', <?= (int)$t['is_active'] ?>)"
+                                <button onclick="openEditModal(<?= $t['id'] ?>, '<?= htmlspecialchars($t['name'], ENT_QUOTES) ?>', <?= (int)$t['max_uses'] ?>, <?= (int)$t['expire_minutes'] ?>, '<?= htmlspecialchars($t['description'] ?? '', ENT_QUOTES) ?>', <?= (int)$t['is_active'] ?>, <?= (int)($t['qos_rate_max_down'] ?? 0) ?>, <?= (int)($t['qos_rate_max_up'] ?? 0) ?>, <?= (int)($t['qos_usage_quota'] ?? 0) ?>)"
                                        class="btn btn-secondary btn-small"><i class="fas fa-edit"></i></button>
                                <a href="?delete=<?= $t['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
                                   onclick="return confirm('Profil wirklich löschen?')"
@ -244,6 +252,11 @@ $adminBase   = '';
                    </div>
                </div>
                <div class="form-group"><label><?= __('templates_desc') ?></label><textarea name="description" rows="2" placeholder="Kurze Beschreibung für Ihr Team"></textarea></div>
+                <div style="display:grid;grid-template-columns:1fr 1fr 1fr;gap:12px;">
+                    <div class="form-group"><label>Download (kbit/s)</label><input type="number" name="qos_rate_max_down" min="0" placeholder="0 = unbegrenzt"></div>
+                    <div class="form-group"><label>Upload (kbit/s)</label><input type="number" name="qos_rate_max_up" min="0" placeholder="0 = unbegrenzt"></div>
+                    <div class="form-group"><label>Datenlimit (MB)</label><input type="number" name="qos_usage_quota" min="0" placeholder="0 = unbegrenzt"></div>
+                </div>
                <div style="display:flex;gap:10px;margin-top:20px;">
                    <button type="submit" name="add_template" class="btn btn-primary" style="flex:1;"><i class="fas fa-save"></i> <?= __('btn_save') ?></button>
                    <button type="button" onclick="closeModal('addModal')" class="btn btn-secondary"><?= __('btn_cancel') ?></button>
@ -276,6 +289,11 @@ $adminBase   = '';
                    </div>
                </div>
                <div class="form-group"><label><?= __('templates_desc') ?></label><textarea name="description" id="editDesc" rows="2"></textarea></div>
+                <div style="display:grid;grid-template-columns:1fr 1fr 1fr;gap:12px;">
+                    <div class="form-group"><label>Download (kbit/s)</label><input type="number" name="qos_rate_max_down" id="editQosDown" min="0" placeholder="0 = unbegrenzt"></div>
+                    <div class="form-group"><label>Upload (kbit/s)</label><input type="number" name="qos_rate_max_up" id="editQosUp" min="0" placeholder="0 = unbegrenzt"></div>
+                    <div class="form-group"><label>Datenlimit (MB)</label><input type="number" name="qos_usage_quota" id="editQosQuota" min="0" placeholder="0 = unbegrenzt"></div>
+                </div>
                <div class="checkbox-group" style="margin-bottom:20px;">
                    <input type="checkbox" name="is_active" id="editActive">
                    <label for="editActive" style="margin:0;"><?= __('status_active') ?></label>
@ -293,13 +311,16 @@ $adminBase   = '';
 <script>
 function openAddModal()  { document.getElementById('addModal').classList.add('active'); }
 function closeModal(id)  { document.getElementById(id).classList.remove('active'); }
-function openEditModal(id, name, maxUses, expMin, desc, isActive) {
+function openEditModal(id, name, maxUses, expMin, desc, isActive, qosDown, qosUp, qosQuota) {
    document.getElementById('editId').value       = id;
    document.getElementById('editName').value     = name;
    document.getElementById('editMaxUses').value  = maxUses;
    document.getElementById('editExpireMin').value = expMin;
    document.getElementById('editDesc').value     = desc;
    document.getElementById('editActive').checked = isActive == 1;
+    document.getElementById('editQosDown').value  = qosDown || '';
+    document.getElementById('editQosUp').value    = qosUp || '';
+    document.getElementById('editQosQuota').value = qosQuota || '';
    document.getElementById('editModal').classList.add('active');
 }
 ['addModal','editModal'].forEach(id => {
--- a/admin/users.php
+++ b/admin/users.php
@ -148,6 +148,14 @@ if (isset($_GET['toggle']) && isset($_GET['token'])) {
    } else { $error = __('error_csrf'); }
 }

+// 2FA eines Benutzers zurücksetzen (Admin-Hilfe bei verlorenem Authenticator)
+if (isset($_GET['reset_2fa']) && isset($_GET['token'])) {
+    if ($auth->validateCsrfToken($_GET['token'])) {
+        $auth->disableTotp((int)$_GET['reset_2fa']);
+        $success = '2FA des Benutzers wurde zurückgesetzt.';
+    } else { $error = __('error_csrf'); }
+}
+
 $users   = $db->fetchAll("SELECT * FROM users ORDER BY name");
 $sites   = $db->fetchAll("SELECT * FROM sites WHERE is_active=1 ORDER BY name");
 $userSiteAccess = [];
@ -304,6 +312,13 @@ $currentPage = 'users';
                                    <i class="fas fa-key"></i>
                                </a>
                                <?php endif; ?>
+                                <?php if (!empty($user['totp_enabled'])): ?>
+                                <a href="?reset_2fa=<?= $user['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
+                                   class="btn btn-secondary btn-sm" title="2FA zurücksetzen"
+                                   onclick="return confirm('2FA für <?= htmlspecialchars($user['email'], ENT_QUOTES) ?> zurücksetzen?')">
+                                    <i class="fas fa-user-shield"></i>
+                                </a>
+                                <?php endif; ?>
                                <a href="?delete=<?= $user['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
                                   class="btn btn-danger btn-sm" title="<?= __('btn_delete') ?>"
                                   onclick="return confirm('Benutzer wirklich löschen?')">
--- a/admin/vouchers.php
+++ b/admin/vouchers.php
@ -96,6 +96,25 @@ if (isset($_POST['ajax_delete']) && isset($_POST['voucher_id']) && isset($_POST[
    exit;
 }

+// Voucher-Code per E-Mail (erneut) versenden
+if (isset($_POST['ajax_resend']) && isset($_POST['voucher_id']) && isset($_POST['site_id'])) {
+    header('Content-Type: application/json');
+    if (!$auth->validateCsrfToken($_POST['csrf_token']??'')) { echo json_encode(['success'=>false,'message'=>__('error_csrf')]); exit; }
+    require_once __DIR__ . '/../includes/Mailer.php';
+    $email = trim($_POST['email'] ?? '');
+    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { echo json_encode(['success'=>false,'message'=>'Ungültige E-Mail-Adresse']); exit; }
+    $siteId = (int)$_POST['site_id'];
+    $site = $db->fetchOne("SELECT * FROM sites WHERE id=?", [$siteId]);
+    $v = $db->fetchOne("SELECT * FROM vouchers WHERE unifi_voucher_id=? AND site_id=?", [$_POST['voucher_id'], $siteId]);
+    if (!$site || !$v) { echo json_encode(['success'=>false,'message'=>'Voucher nicht gefunden']); exit; }
+    $mailer = new Mailer();
+    $code = strpos($v['voucher_code'], '-') !== false ? $v['voucher_code'] : implode('-', str_split($v['voucher_code'], 5));
+    $ok = $mailer->sendVoucherEmail($email, $code, $site['name'], (int)$v['max_uses']);
+    $auth->writeAuditLog($_SESSION['user_id'], 'voucher_resend', 'voucher', $v['id'], "Code an $email gesendet");
+    echo json_encode(['success'=>$ok, 'message'=>$ok ? 'E-Mail versendet.' : 'Versand fehlgeschlagen.']);
+    exit;
+}
+
 $sites = $db->fetchAll("SELECT * FROM sites WHERE is_active=1 ORDER BY name");
 $siteStats = [];
 foreach ($sites as $site) {
@ -383,7 +402,10 @@ function renderVouchers() {
            <td>${statusBadge}</td>
            <td><div class="usage-info"><span>${v.used}/${v.quota>0?v.quota:'∞'}</span>${v.quota>0?`<div class="usage-bar"><div class="usage-bar-fill" style="width:${usagePct}%"></div></div>`:''}</div></td>
            <td>${remaining?`<span style="color:var(--success)"><i class="fas fa-clock"></i> ${remaining}</span><br>`:''}<small style="color:var(--text-muted)">${v.duration} Min.</small></td>
-            <td><button onclick="deleteVoucher('${v._id}')" class="btn btn-danger btn-sm" title="<?= __('btn_delete') ?>"><i class="fas fa-trash"></i></button></td>
+            <td style="white-space:nowrap;">
+                <button onclick="resendVoucher('${v._id}','${escapeHtml(v.formatted_code||'')}')" class="btn btn-secondary btn-sm" title="Per E-Mail senden"><i class="fas fa-envelope"></i></button>
+                <button onclick="deleteVoucher('${v._id}')" class="btn btn-danger btn-sm" title="<?= __('btn_delete') ?>"><i class="fas fa-trash"></i></button>
+            </td>
        </tr>`;
    });

@ -407,6 +429,20 @@ function renderVouchers() {

 function escapeHtml(t) { const d=document.createElement('div'); d.textContent=t; return d.innerHTML; }

+async function resendVoucher(voucherId, code) {
+    const email = prompt('Code ' + code + ' senden an (E-Mail):');
+    if (!email) return;
+    const fd = new FormData();
+    fd.append('ajax_resend','1'); fd.append('voucher_id',voucherId);
+    fd.append('site_id', currentSiteId); fd.append('email', email);
+    fd.append('csrf_token', csrfToken);
+    try {
+        const r = await fetch('vouchers.php', {method:'POST', body:fd});
+        const d = await r.json();
+        (window.showToast ? showToast(d.message, d.success?'success':'error') : alert(d.message));
+    } catch(e){ alert('Fehler: '+e.message); }
+}
+
 async function deleteVoucher(voucherId) {
    if (!confirm('Voucher wirklich löschen?')) return;
    const row = document.getElementById(`voucher-${voucherId}`);
--- a/api/bootstrap.php
+++ b/api/bootstrap.php
@ -0,0 +1,53 @@
+<?php
+/**
+ * Gemeinsamer Bootstrap für die REST-API-Endpunkte.
+ * Lädt die Basis, authentifiziert den API-Schlüssel und stellt JSON-Helfer bereit.
+ */
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/../config.php';
+require_once __DIR__ . '/../includes/Database.php';
+require_once __DIR__ . '/../includes/UniFiController.php';
+require_once __DIR__ . '/../includes/ApiKey.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+function api_json($data, $status = 200) {
+    http_response_code($status);
+    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+    exit;
+}
+
+function api_body() {
+    $raw = file_get_contents('php://input');
+    if ($raw === '' || $raw === false) return [];
+    $data = json_decode($raw, true);
+    return is_array($data) ? $data : [];
+}
+
+try {
+    $db = Database::getInstance();
+} catch (Exception $e) {
+    api_json(['error' => 'database_unavailable'], 503);
+}
+
+$apiKeyRow = ApiKey::verify(ApiKey::fromRequest(), $db);
+if (!$apiKeyRow) {
+    api_json(['error' => 'unauthorized', 'message' => 'Gültiger API-Schlüssel erforderlich (Authorization: Bearer …)'], 401);
+}
+
+// Rate-Limit pro Schlüssel
+if (!ApiKey::checkRateLimit($apiKeyRow, $db)) {
+    header('Retry-After: 60');
+    api_json(['error' => 'rate_limited', 'message' => 'Rate-Limit überschritten. Bitte später erneut versuchen.'], 429);
+}
+
+/** Erzwingt einen Scope für den aktuellen Schlüssel. */
+function api_require_scope($needed) {
+    global $apiKeyRow;
+    if (!ApiKey::hasScope($apiKeyRow, $needed)) {
+        api_json(['error' => 'forbidden', 'message' => "Schlüssel hat keinen '$needed'-Scope"], 403);
+    }
+}
--- a/api/openapi.php
+++ b/api/openapi.php
@ -0,0 +1,77 @@
+<?php
+/**
+ * OpenAPI 3.0 Spezifikation der REST-API (zum Import in Postman/Swagger).
+ * GET /api/openapi.php
+ */
+header('Content-Type: application/json; charset=utf-8');
+
+$scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
+$host   = $_SERVER['HTTP_HOST'] ?? 'localhost';
+$base   = $scheme . '://' . $host . rtrim(dirname($_SERVER['SCRIPT_NAME']), '/');
+
+$spec = [
+    'openapi' => '3.0.3',
+    'info' => [
+        'title'       => 'UniFi Voucher Tool API',
+        'version'     => '1.0.0',
+        'description' => 'REST-API zum Erstellen und Abrufen von WLAN-Vouchers. Authentifizierung per API-Schlüssel (Authorization: Bearer … oder X-API-Key).',
+    ],
+    'servers' => [['url' => $base]],
+    'components' => [
+        'securitySchemes' => [
+            'bearerAuth' => ['type' => 'http', 'scheme' => 'bearer'],
+            'apiKeyAuth' => ['type' => 'apiKey', 'in' => 'header', 'name' => 'X-API-Key'],
+        ],
+    ],
+    'security' => [['bearerAuth' => []], ['apiKeyAuth' => []]],
+    'paths' => [
+        '/sites.php' => [
+            'get' => [
+                'summary' => 'Aktive Sites auflisten',
+                'description' => 'Erfordert Scope read.',
+                'responses' => ['200' => ['description' => 'Liste der Sites']],
+            ],
+        ],
+        '/vouchers.php' => [
+            'get' => [
+                'summary' => 'Voucher einer Site auflisten',
+                'description' => 'Erfordert Scope read.',
+                'parameters' => [[
+                    'name' => 'site_id', 'in' => 'query', 'required' => true,
+                    'schema' => ['type' => 'integer'],
+                ]],
+                'responses' => ['200' => ['description' => 'Liste der Voucher']],
+            ],
+            'post' => [
+                'summary' => 'Voucher erstellen',
+                'description' => 'Erfordert Scope write.',
+                'requestBody' => [
+                    'required' => true,
+                    'content' => ['application/json' => ['schema' => [
+                        'type' => 'object',
+                        'required' => ['site_id', 'name'],
+                        'properties' => [
+                            'site_id'        => ['type' => 'integer'],
+                            'name'           => ['type' => 'string'],
+                            'max_uses'       => ['type' => 'integer', 'default' => 1],
+                            'expire_minutes' => ['type' => 'integer', 'default' => 480],
+                            'qos' => ['type' => 'object', 'properties' => [
+                                'down'     => ['type' => 'integer', 'description' => 'Download kbit/s'],
+                                'up'       => ['type' => 'integer', 'description' => 'Upload kbit/s'],
+                                'quota_mb' => ['type' => 'integer', 'description' => 'Datenkontingent MB'],
+                            ]],
+                        ],
+                    ]]],
+                ],
+                'responses' => [
+                    '201' => ['description' => 'Voucher erstellt'],
+                    '401' => ['description' => 'Nicht authentifiziert'],
+                    '403' => ['description' => 'Fehlender Scope'],
+                    '429' => ['description' => 'Rate-Limit überschritten'],
+                ],
+            ],
+        ],
+    ],
+];
+
+echo json_encode($spec, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
--- a/api/sites.php
+++ b/api/sites.php
@ -0,0 +1,15 @@
+<?php
+/**
+ * GET /api/sites.php  – Liste aktiver Sites (für API-Clients).
+ */
+require_once __DIR__ . '/bootstrap.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
+    api_json(['error' => 'method_not_allowed'], 405);
+}
+api_require_scope('read');
+
+$sites = $db->fetchAll("SELECT id, name, site_id FROM sites WHERE is_active = 1 ORDER BY name");
+api_json(['sites' => array_map(function ($s) {
+    return ['id' => (int)$s['id'], 'name' => $s['name'], 'site_id' => $s['site_id']];
+}, $sites)]);
--- a/api/vouchers.php
+++ b/api/vouchers.php
@ -0,0 +1,91 @@
+<?php
+/**
+ * REST-Endpunkt für Voucher.
+ *
+ *   GET  /api/vouchers.php?site_id=<id>        – Voucher einer Site auflisten (aus DB)
+ *   POST /api/vouchers.php                     – Voucher erstellen
+ *        Body (JSON): {
+ *          "site_id": 1, "name": "API Gast", "max_uses": 1,
+ *          "expire_minutes": 480,
+ *          "qos": { "down": 10000, "up": 2000, "quota_mb": 500 }   (optional)
+ *        }
+ */
+require_once __DIR__ . '/bootstrap.php';
+require_once __DIR__ . '/../includes/Notifier.php';
+
+$method = $_SERVER['REQUEST_METHOD'];
+
+if ($method === 'GET') {
+    api_require_scope('read');
+    $siteId = (int)($_GET['site_id'] ?? 0);
+    if ($siteId <= 0) {
+        api_json(['error' => 'invalid_request', 'message' => 'site_id erforderlich'], 400);
+    }
+    $rows = $db->fetchAll(
+        "SELECT voucher_code, voucher_name, max_uses, expire_minutes, status, used_count, created_at, expires_at
+         FROM vouchers WHERE site_id = ? ORDER BY created_at DESC LIMIT 200",
+        [$siteId]
+    );
+    api_json(['vouchers' => $rows]);
+}
+
+if ($method === 'POST') {
+    api_require_scope('write');
+    $body          = api_body();
+    $siteId        = (int)($body['site_id'] ?? 0);
+    $name          = trim((string)($body['name'] ?? ''));
+    $maxUses       = (int)($body['max_uses'] ?? 1);
+    $expireMinutes = (int)($body['expire_minutes'] ?? 480);
+
+    if ($siteId <= 0)        api_json(['error' => 'invalid_request', 'message' => 'site_id erforderlich'], 400);
+    if ($name === '')        api_json(['error' => 'invalid_request', 'message' => 'name erforderlich'], 400);
+    if ($maxUses < 1)        $maxUses = 1;
+    if ($expireMinutes < 1)  $expireMinutes = 480;
+
+    $site = $db->fetchOne("SELECT * FROM sites WHERE id = ? AND is_active = 1", [$siteId]);
+    if (!$site) {
+        api_json(['error' => 'not_found', 'message' => 'Site nicht gefunden'], 404);
+    }
+
+    $qosIn = is_array($body['qos'] ?? null) ? $body['qos'] : [];
+    $qos = [
+        'down'     => max(0, (int)($qosIn['down'] ?? 0)),
+        'up'       => max(0, (int)($qosIn['up'] ?? 0)),
+        'quota_mb' => max(0, (int)($qosIn['quota_mb'] ?? 0)),
+    ];
+
+    try {
+        $fullName   = date('Y-m-d') . '_' . $name;
+        $controller = new UniFiController(
+            $site['unifi_controller_url'],
+            $site['unifi_username'],
+            Crypto::decrypt($site['unifi_password']),
+            $site['site_id']
+        );
+        $voucher = $controller->createVoucher($fullName, $maxUses, $expireMinutes, $qos);
+        if (!is_array($voucher) || empty($voucher['formatted_code'])) {
+            api_json(['error' => 'upstream_error', 'message' => 'UniFi lieferte keinen gültigen Voucher'], 502);
+        }
+
+        $db->execute(
+            "INSERT INTO vouchers (site_id, user_id, voucher_code, voucher_name, max_uses, expire_minutes, unifi_voucher_id)
+             VALUES (?, NULL, ?, ?, ?, ?, ?)",
+            [$siteId, $voucher['code'], $fullName, $maxUses, $expireMinutes, $voucher['unifi_id'] ?? null]
+        );
+
+        Notifier::voucherCreated(1, $site['name'], 'API: ' . $apiKeyRow['name']);
+
+        api_json([
+            'success'        => true,
+            'code'           => $voucher['code'],
+            'formatted_code' => $voucher['formatted_code'],
+            'site'           => $site['name'],
+            'max_uses'       => $maxUses,
+            'expire_minutes' => $expireMinutes,
+        ], 201);
+    } catch (Exception $e) {
+        api_json(['error' => 'server_error', 'message' => $e->getMessage()], 500);
+    }
+}
+
+api_json(['error' => 'method_not_allowed'], 405);
--- a/composer.json
+++ b/composer.json
@ -0,0 +1,21 @@
+{
+    "name": "friloo/unifi-voucher-tool",
+    "description": "Webbasiertes WLAN-Voucher-Management für UniFi OS",
+    "license": "MIT",
+    "require": {
+        "php": ">=7.4"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "^9.6",
+        "phpstan/phpstan": "^1.11"
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Tests\\": "tests/"
+        }
+    },
+    "scripts": {
+        "test": "phpunit",
+        "stan": "phpstan analyse"
+    }
+}
--- a/cron_cleanup.php
+++ b/cron_cleanup.php
@ -0,0 +1,136 @@
+<?php
+/**
+ * Cron-Script für Aufräumarbeiten & Datenhaltung (DSGVO).
+ *
+ * Aufruf via URL: https://domain.de/cron_cleanup.php?token=DEIN_TOKEN
+ * Aufruf via CLI: php cron_cleanup.php DEIN_TOKEN
+ *
+ * Empfohlenes Intervall: täglich.
+ *
+ * Gesteuert über Einstellungen (0 = deaktiviert):
+ *   cleanup_expired_days      – abgelaufene Voucher nach N Tagen aus DB löschen
+ *   cleanup_audit_days        – Audit-Log-Einträge nach N Tagen löschen
+ *   cleanup_login_days        – Login-Versuche nach N Tagen löschen (Default 30)
+ * Abgelaufene/benutzte Passwort-Reset-Tokens werden immer entfernt.
+ */
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+
+$isCli = php_sapi_name() === 'cli';
+if (!$isCli) {
+    header('Content-Type: application/json');
+}
+
+require_once __DIR__ . '/config.php';
+require_once __DIR__ . '/includes/Database.php';
+require_once __DIR__ . '/includes/Notifier.php';
+
+function out($data, $isCli) {
+    if ($isCli) {
+        echo ($data['success'] ? 'SUCCESS' : 'ERROR') . ': ' . ($data['message'] ?? '') . PHP_EOL;
+        if (!empty($data['deleted'])) {
+            foreach ($data['deleted'] as $k => $v) echo "  - $k: $v" . PHP_EOL;
+        }
+    } else {
+        echo json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE);
+    }
+}
+
+try {
+    $db = Database::getInstance();
+} catch (Exception $e) {
+    out(['success' => false, 'message' => 'DB-Fehler: ' . $e->getMessage()], $isCli);
+    exit;
+}
+
+// Token prüfen (gleicher Token wie cron_sync)
+$cronToken = $db->getSetting('cron_token', '');
+$provided  = $isCli ? ($argv[1] ?? '') : ($_GET['token'] ?? '');
+if (empty($cronToken)) {
+    out(['success' => false, 'message' => 'Kein Cron-Token konfiguriert.'], $isCli);
+    exit;
+}
+if (!hash_equals($cronToken, (string)$provided)) {
+    out(['success' => false, 'message' => 'Ungültiger Token'], $isCli);
+    exit;
+}
+
+$expiredDays = (int)$db->getSetting('cleanup_expired_days', 0);
+$auditDays   = (int)$db->getSetting('cleanup_audit_days', 0);
+$loginDays   = (int)$db->getSetting('cleanup_login_days', 30);
+
+$deleted = [];
+
+try {
+    // Abgelaufene Voucher aus der DB entfernen (nur lokale Historie)
+    if ($expiredDays > 0) {
+        $stmt = $db->query(
+            "DELETE FROM vouchers WHERE status = 'expired'
+             AND expires_at IS NOT NULL AND expires_at < DATE_SUB(NOW(), INTERVAL ? DAY)",
+            [$expiredDays]
+        );
+        $deleted['vouchers_expired'] = $stmt->rowCount();
+    }
+
+    // Audit-Log nach Aufbewahrungsfrist löschen
+    if ($auditDays > 0) {
+        try {
+            $stmt = $db->query(
+                "DELETE FROM audit_log WHERE created_at < DATE_SUB(NOW(), INTERVAL ? DAY)",
+                [$auditDays]
+            );
+            $deleted['audit_log'] = $stmt->rowCount();
+        } catch (Exception $e) { /* Tabelle evtl. nicht vorhanden */ }
+    }
+
+    // Alte Login-Versuche entfernen
+    if ($loginDays > 0) {
+        try {
+            $stmt = $db->query(
+                "DELETE FROM login_attempts WHERE attempted_at < DATE_SUB(NOW(), INTERVAL ? DAY)",
+                [$loginDays]
+            );
+            $deleted['login_attempts'] = $stmt->rowCount();
+        } catch (Exception $e) { /* ignore */ }
+    }
+
+    // Abgelaufene / benutzte Passwort-Reset-Tokens immer entfernen
+    try {
+        $stmt = $db->query(
+            "DELETE FROM password_reset_tokens WHERE used = 1 OR expires_at < NOW()"
+        );
+        $deleted['reset_tokens'] = $stmt->rowCount();
+    } catch (Exception $e) { /* Tabelle evtl. nicht vorhanden */ }
+
+    // Optionaler täglicher Update-Check mit Webhook-Hinweis (Updater isoliert,
+    // daher nur falls vorhanden und nur einmal pro Tag).
+    $bootstrap = __DIR__ . '/updater/bootstrap.php';
+    if (is_file($bootstrap)) {
+        $lastCheck = $db->getSetting('last_update_check', '');
+        if (!$lastCheck || strtotime($lastCheck) < strtotime('-23 hours')) {
+            try {
+                require_once $bootstrap;
+                $mgr = \Updater\UpdaterFactory::create($db, null);
+                $res = $mgr->checkForUpdates();
+                if (!empty($res['has_update'])) {
+                    Notifier::updateAvailable($res['latest_sha'] ?? '');
+                }
+            } catch (\Throwable $e) { /* Update-Check nie blockierend */ }
+            $db->setSetting('last_update_check', date('Y-m-d H:i:s'));
+        }
+    }
+
+    $db->query(
+        "INSERT INTO settings (setting_key, setting_value) VALUES ('last_cleanup', NOW())
+         ON DUPLICATE KEY UPDATE setting_value = NOW()"
+    );
+
+    out([
+        'success'   => true,
+        'message'   => 'Cleanup abgeschlossen',
+        'deleted'   => $deleted,
+        'timestamp' => date('Y-m-d H:i:s'),
+    ], $isCli);
+} catch (Exception $e) {
+    out(['success' => false, 'message' => 'Fehler: ' . $e->getMessage(), 'deleted' => $deleted], $isCli);
+}
--- a/cron_sync.php
+++ b/cron_sync.php
@ -90,6 +90,7 @@ set_exception_handler(function($e) use ($isCli) {
 require_once __DIR__ . '/config.php';
 require_once __DIR__ . '/includes/Database.php';
 require_once __DIR__ . '/includes/UniFiController.php';
+require_once __DIR__ . '/includes/Notifier.php';

 $db = Database::getInstance();

@ -194,6 +195,9 @@ try {
            $siteResult['error'] = $e->getMessage();
            $totalStats['sites_failed']++;
            logMessage("  FEHLER - " . $e->getMessage(), $isCli);
+            if (class_exists('Notifier')) {
+                Notifier::controllerUnreachable($site['name'], $e->getMessage());
+            }
        }

        $results[] = $siteResult;
--- a/database.sql
+++ b/database.sql
@ -30,6 +30,9 @@ CREATE TABLE IF NOT EXISTS `users` (
  `is_admin` TINYINT(1) DEFAULT 0,
  `is_active` TINYINT(1) DEFAULT 1,
  `microsoft_id` VARCHAR(255) UNIQUE,
+  `totp_secret` VARCHAR(64) NULL,
+  `totp_enabled` TINYINT(1) NOT NULL DEFAULT 0,
+  `totp_backup_codes` TEXT NULL,
  `last_login` TIMESTAMP NULL,
  `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@ -53,6 +56,9 @@ CREATE TABLE IF NOT EXISTS `voucher_templates` (
  `max_uses` INT NOT NULL DEFAULT 1,
  `expire_minutes` INT NOT NULL DEFAULT 480,
  `description` VARCHAR(500),
+  `qos_rate_max_down` INT NULL,
+  `qos_rate_max_up` INT NULL,
+  `qos_usage_quota` INT NULL,
  `is_active` TINYINT(1) DEFAULT 1,
  `created_by` INT,
  `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
@ -60,6 +66,29 @@ CREATE TABLE IF NOT EXISTS `voucher_templates` (
  FOREIGN KEY (`created_by`) REFERENCES `users`(`id`) ON DELETE SET NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

+CREATE TABLE IF NOT EXISTS `api_keys` (
+  `id` INT PRIMARY KEY AUTO_INCREMENT,
+  `name` VARCHAR(255) NOT NULL,
+  `key_prefix` VARCHAR(16) NOT NULL,
+  `key_hash` VARCHAR(255) NOT NULL,
+  `scope` VARCHAR(16) NOT NULL DEFAULT 'write',
+  `rate_limit` INT NOT NULL DEFAULT 0,
+  `created_by` INT,
+  `last_used_at` TIMESTAMP NULL,
+  `is_active` TINYINT(1) NOT NULL DEFAULT 1,
+  `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+  FOREIGN KEY (`created_by`) REFERENCES `users`(`id`) ON DELETE SET NULL,
+  INDEX `idx_prefix` (`key_prefix`),
+  INDEX `idx_active` (`is_active`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE IF NOT EXISTS `api_key_hits` (
+  `id` BIGINT PRIMARY KEY AUTO_INCREMENT,
+  `api_key_id` INT NOT NULL,
+  `hit_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+  INDEX `idx_key_time` (`api_key_id`, `hit_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
 CREATE TABLE IF NOT EXISTS `vouchers` (
  `id` INT PRIMARY KEY AUTO_INCREMENT,
  `site_id` INT NOT NULL,
@ -85,7 +114,7 @@ CREATE TABLE IF NOT EXISTS `vouchers` (

 CREATE TABLE IF NOT EXISTS `sessions` (
  `id` VARCHAR(128) PRIMARY KEY,
-  `user_id` INT NOT NULL,
+  `user_id` INT NULL,
  `data` TEXT,
  `expires_at` TIMESTAMP NOT NULL,
  `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -0,0 +1,38 @@
+services:
+  app:
+    build: .
+    ports:
+      - "8080:80"
+    environment:
+      DB_HOST: db
+      DB_NAME: unifi_voucher
+      DB_USER: unifi_voucher
+      DB_PASS: change_me
+      # Dauerhaft setzen! Sonst koennen verschluesselte Werte nach Neustart
+      # nicht mehr gelesen werden. Erzeugen: php -r "echo base64_encode(random_bytes(32));"
+      APP_KEY: ""
+      TZ: Europe/Berlin
+    depends_on:
+      db:
+        condition: service_healthy
+    restart: unless-stopped
+
+  db:
+    image: mariadb:11
+    environment:
+      MARIADB_DATABASE: unifi_voucher
+      MARIADB_USER: unifi_voucher
+      MARIADB_PASSWORD: change_me
+      MARIADB_ROOT_PASSWORD: change_me_root
+    volumes:
+      - db_data:/var/lib/mysql
+      - ./database.sql:/docker-entrypoint-initdb.d/01_schema.sql:ro
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+volumes:
+  db_data:
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@ -0,0 +1,29 @@
+#!/bin/sh
+set -e
+
+CONFIG=/var/www/html/config.php
+
+# config.php aus Umgebungsvariablen erzeugen, falls noch nicht vorhanden und
+# DB-Variablen gesetzt sind. Sonst kann der Web-Installer (install.php) genutzt
+# werden. APP_KEY wird einmalig generiert und sollte als ENV persistiert werden.
+if [ ! -f "$CONFIG" ] && [ -n "$DB_HOST" ] && [ -n "$DB_NAME" ]; then
+  if [ -z "$APP_KEY" ]; then
+    APP_KEY=$(php -r 'echo base64_encode(random_bytes(32));')
+    echo "[entrypoint] WARN: kein APP_KEY gesetzt – generiere einmaligen Schluessel."
+    echo "[entrypoint]       Fuer dauerhaften Betrieb APP_KEY als ENV setzen: $APP_KEY"
+  fi
+  cat > "$CONFIG" <<PHP
+<?php
+define('DB_HOST', getenv('DB_HOST') ?: '${DB_HOST}');
+define('DB_NAME', getenv('DB_NAME') ?: '${DB_NAME}');
+define('DB_USER', getenv('DB_USER') ?: '${DB_USER}');
+define('DB_PASS', getenv('DB_PASS') ?: '${DB_PASS}');
+define('APP_KEY', getenv('APP_KEY') ?: '${APP_KEY}');
+define('SESSION_LIFETIME', (int)(getenv('SESSION_LIFETIME') ?: 3600));
+date_default_timezone_set(getenv('TZ') ?: 'Europe/Berlin');
+PHP
+  chown www-data:www-data "$CONFIG"
+  echo "[entrypoint] config.php aus ENV erzeugt."
+fi
+
+exec "$@"
--- a/docs/screenshots/admin-dashboard-dark.png
+++ b/docs/screenshots/admin-dashboard-dark.png
--- a/docs/screenshots/admin-dashboard.png
+++ b/docs/screenshots/admin-dashboard.png
--- a/docs/screenshots/api-keys.png
+++ b/docs/screenshots/api-keys.png
--- a/docs/screenshots/bulk-vouchers.png
+++ b/docs/screenshots/bulk-vouchers.png
--- a/docs/screenshots/integrations.png
+++ b/docs/screenshots/integrations.png
--- a/docs/screenshots/login.png
+++ b/docs/screenshots/login.png
--- a/docs/screenshots/maintenance.png
+++ b/docs/screenshots/maintenance.png
--- a/docs/screenshots/two-factor.png
+++ b/docs/screenshots/two-factor.png
--- a/docs/screenshots/updater-available.png
+++ b/docs/screenshots/updater-available.png
--- a/docs/screenshots/updater.png
+++ b/docs/screenshots/updater.png
--- a/docs/screenshots/voucher-form.png
+++ b/docs/screenshots/voucher-form.png
--- a/docs/screenshots/voucher-result.png
+++ b/docs/screenshots/voucher-result.png
--- a/forgot_password.php
+++ b/forgot_password.php
@ -24,9 +24,16 @@ $success = '';
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = trim($_POST['email'] ?? '');

-    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+    // Einfacher Throttle: max. 3 Anfragen pro 15 Minuten je Session (gegen Spam)
+    $now = time();
+    $rl = array_values(array_filter($_SESSION['pwreset_times'] ?? [], fn($t) => ($now - $t) < 900));
+    if (count($rl) >= 3) {
+        $error = 'Zu viele Anfragen. Bitte warten Sie einige Minuten.';
+    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $error = __('error_email_invalid');
    } else {
+        $rl[] = $now;
+        $_SESSION['pwreset_times'] = $rl;
        $user = $db->fetchOne("SELECT * FROM users WHERE email = ? AND is_active = 1 AND password_hash IS NOT NULL", [$email]);

        // Always show success (don't reveal whether email exists)
--- a/health.php
+++ b/health.php
@ -0,0 +1,59 @@
+<?php
+/**
+ * Health-/Status-Endpunkt für Monitoring/Uptime-Checks.
+ *
+ *   GET /health.php            – Basis-Status (DB erreichbar), kein Geheimnis
+ *   GET /health.php?deep=1&token=CRON_TOKEN – zusätzlich Controller-Erreichbarkeit
+ *
+ * Antwortet HTTP 200 (ok) oder 503 (degraded/fail).
+ */
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+header('Content-Type: application/json; charset=utf-8');
+
+require_once __DIR__ . '/config.php';
+require_once __DIR__ . '/includes/Database.php';
+
+$result = ['status' => 'ok', 'time' => date('c'), 'checks' => []];
+$httpStatus = 200;
+
+// DB
+try {
+    $db = Database::getInstance();
+    $db->fetchOne("SELECT 1 AS ok");
+    $result['checks']['database'] = 'ok';
+} catch (Throwable $e) {
+    $result['checks']['database'] = 'fail';
+    $result['status'] = 'fail';
+    $httpStatus = 503;
+    echo json_encode($result);
+    http_response_code($httpStatus);
+    exit;
+}
+
+$result['checks']['active_sites'] = (int)($db->fetchOne("SELECT COUNT(*) c FROM sites WHERE is_active=1")['c'] ?? 0);
+
+// Tiefer Check (Controller) nur mit gültigem Cron-Token
+if (isset($_GET['deep']) && $_GET['deep'] == '1') {
+    $token = $db->getSetting('cron_token', '');
+    if ($token === '' || !hash_equals($token, (string)($_GET['token'] ?? ''))) {
+        http_response_code(403);
+        echo json_encode(['status' => 'forbidden', 'message' => 'deep check erfordert gültigen token']);
+        exit;
+    }
+    require_once __DIR__ . '/includes/UniFiController.php';
+    $controllers = [];
+    foreach ($db->fetchAll("SELECT * FROM sites WHERE is_active=1") as $site) {
+        $r = UniFiController::testConnection(
+            $site['unifi_controller_url'], $site['unifi_username'],
+            Crypto::decrypt($site['unifi_password']), $site['site_id']
+        );
+        $ok = ($r === true);
+        $controllers[$site['name']] = $ok ? 'ok' : 'unreachable';
+        if (!$ok) { $result['status'] = 'degraded'; $httpStatus = 503; }
+    }
+    $result['checks']['controllers'] = $controllers;
+}
+
+http_response_code($httpStatus);
+echo json_encode($result, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
--- a/includes/ApiKey.php
+++ b/includes/ApiKey.php
@ -0,0 +1,103 @@
+<?php
+/**
+ * ApiKey – Erzeugung & Verifizierung von API-Schlüsseln für die REST-API.
+ *
+ * Schlüsselformat:  uvt_<prefix(8)><secret(32)>
+ * Gespeichert wird nur der SHA-256-Hash plus ein indexierbares Präfix – der
+ * Klartext-Schlüssel wird dem Admin genau einmal bei der Erstellung gezeigt.
+ */
+class ApiKey {
+    /** Neuen Schlüssel erzeugen. Gibt plain/prefix/hash zurück. */
+    public static function generate() {
+        $prefix = bin2hex(random_bytes(4));   // 8 Zeichen
+        $secret = bin2hex(random_bytes(16));   // 32 Zeichen
+        $plain  = 'uvt_' . $prefix . $secret;
+        return [
+            'plain'  => $plain,
+            'prefix' => $prefix,
+            'hash'   => hash('sha256', $plain),
+        ];
+    }
+
+    /**
+     * Verifiziert einen Klartext-Schlüssel gegen die DB. Aktualisiert
+     * last_used_at und gibt den Key-Datensatz zurück – oder false.
+     */
+    public static function verify($plain, $db) {
+        if (!is_string($plain) || strpos($plain, 'uvt_') !== 0 || strlen($plain) < 44) {
+            return false;
+        }
+        $prefix = substr($plain, 4, 8);
+        $hash   = hash('sha256', $plain);
+        try {
+            $row = $db->fetchOne(
+                "SELECT * FROM api_keys WHERE key_prefix = ? AND is_active = 1",
+                [$prefix]
+            );
+        } catch (\Exception $e) {
+            return false;
+        }
+        if (!$row || !hash_equals($row['key_hash'], $hash)) {
+            return false;
+        }
+        try {
+            $db->query("UPDATE api_keys SET last_used_at = NOW() WHERE id = ?", [$row['id']]);
+        } catch (\Exception $e) { /* ignore */ }
+        return $row;
+    }
+
+    /**
+     * Fixed-Window-Rate-Limit pro Schlüssel (Anfragen/Minute). rate_limit = 0
+     * bedeutet unbegrenzt. Gibt true zurück, wenn die Anfrage erlaubt ist.
+     */
+    public static function checkRateLimit($row, $db) {
+        $limit = (int)($row['rate_limit'] ?? 0);
+        if ($limit <= 0) {
+            return true;
+        }
+        try {
+            // alte Treffer (>60s) aufräumen
+            $db->query("DELETE FROM api_key_hits WHERE api_key_id = ? AND hit_at < DATE_SUB(NOW(), INTERVAL 60 SECOND)", [$row['id']]);
+            $cnt = $db->fetchOne("SELECT COUNT(*) AS c FROM api_key_hits WHERE api_key_id = ?", [$row['id']]);
+            if ($cnt && (int)$cnt['c'] >= $limit) {
+                return false;
+            }
+            $db->query("INSERT INTO api_key_hits (api_key_id) VALUES (?)", [$row['id']]);
+        } catch (\Exception $e) {
+            return true; // Bei Fehlern (z.B. Tabelle fehlt) nicht blockieren
+        }
+        return true;
+    }
+
+    /** Prüft, ob der Schlüssel den geforderten Scope hat ('read' < 'write'). */
+    public static function hasScope($row, $needed) {
+        $scope = $row['scope'] ?? 'write';
+        if ($needed === 'read') {
+            return in_array($scope, ['read', 'write'], true);
+        }
+        return $scope === 'write';
+    }
+
+    /** Liest den Schlüssel aus dem Request (Authorization: Bearer / X-API-Key). */
+    public static function fromRequest() {
+        $headers = [];
+        if (function_exists('getallheaders')) {
+            foreach (getallheaders() as $k => $v) {
+                $headers[strtolower($k)] = $v;
+            }
+        }
+        if (!empty($headers['authorization']) && preg_match('/Bearer\s+(\S+)/i', $headers['authorization'], $m)) {
+            return $m[1];
+        }
+        if (!empty($headers['x-api-key'])) {
+            return trim($headers['x-api-key']);
+        }
+        if (!empty($_SERVER['HTTP_X_API_KEY'])) {
+            return trim($_SERVER['HTTP_X_API_KEY']);
+        }
+        if (!empty($_SERVER['HTTP_AUTHORIZATION']) && preg_match('/Bearer\s+(\S+)/i', $_SERVER['HTTP_AUTHORIZATION'], $m)) {
+            return $m[1];
+        }
+        return null;
+    }
+}
--- a/includes/Auth.php
+++ b/includes/Auth.php
@ -1,4 +1,8 @@
 <?php
+require_once __DIR__ . '/Totp.php';
+require_once __DIR__ . '/Notifier.php';
+require_once __DIR__ . '/Crypto.php';
+
 class Auth {
    private $db;
    
@ -15,15 +19,49 @@ class Auth {
            ini_set('session.use_strict_mode', 1);
            ini_set('session.cookie_samesite', 'Lax');

+            // Opt-in: Sessions in der DB ablegen (für "überall abmelden" / Skalierung)
+            try {
+                if ($this->db->getSetting('session_driver', 'php') === 'db') {
+                    require_once __DIR__ . '/DbSessionHandler.php';
+                    $ttl = defined('SESSION_LIFETIME') ? (int)SESSION_LIFETIME : 3600;
+                    session_set_save_handler(new DbSessionHandler($this->db, $ttl), true);
+                }
+            } catch (\Throwable $e) { /* Fallback: Standard-PHP-Sessions */ }
+
            if (!session_start()) {
                die("Session konnte nicht gestartet werden");
            }
        }
    }
    
+    /**
+     * Ermittelt die echte Client-IP. Hinter einem konfigurierten Trusted-Proxy
+     * (Setting `trusted_proxy`, kommaseparierte IP-Liste) wird die erste IP aus
+     * X-Forwarded-For verwendet, sonst REMOTE_ADDR. Verhindert, dass ein
+     * Reverse-Proxy alle Clients als dieselbe IP erscheinen laesst (Rate-Limit).
+     */
+    public function clientIp() {
+        $remote = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+        try {
+            $trusted = (string)$this->db->getSetting('trusted_proxy', '');
+        } catch (\Exception $e) {
+            $trusted = '';
+        }
+        if ($trusted === '' || empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+            return $remote;
+        }
+        $trustedList = array_filter(array_map('trim', explode(',', $trusted)));
+        if (!in_array($remote, $trustedList, true)) {
+            return $remote; // Anfrage kam nicht vom Trusted-Proxy -> XFF ignorieren
+        }
+        $parts = array_filter(array_map('trim', explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])));
+        $client = $parts[0] ?? $remote;
+        return filter_var($client, FILTER_VALIDATE_IP) ? $client : $remote;
+    }
+
    // Benutzer einloggen
    public function login($email, $password) {
-        $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+        $ip = $this->clientIp();

        if ($this->isRateLimited($ip, $email)) {
            return 'rate_limited';
@ -36,6 +74,15 @@ class Auth {

        if ($user && password_verify($password, $user['password_hash'])) {
            $this->clearLoginAttempts($ip, $email);
+
+            // 2FA aktiv? Dann Login zunaechst nur "vormerken" und Code anfordern.
+            if (!empty($user['totp_enabled']) && !empty($user['totp_secret'])) {
+                $_SESSION['totp_pending_user_id'] = $user['id'];
+                $_SESSION['totp_pending_time'] = time();
+                return 'totp_required';
+            }
+
+            $this->notifyIfNewIp($user, $ip);
            $this->setUserSession($user);
            $this->updateLastLogin($user['id']);
            $this->writeAuditLog($user['id'], 'user_login', 'user', $user['id'], 'Login erfolgreich');
@ -46,11 +93,135 @@ class Auth {
        return false;
    }

+    /** Webhook bei Login von einer für diesen Nutzer bisher unbekannten IP. */
+    private function notifyIfNewIp($user, $ip) {
+        try {
+            $seen = $this->db->fetchOne(
+                "SELECT 1 FROM audit_log WHERE user_id = ? AND action = 'user_login' AND ip_address = ? LIMIT 1",
+                [$user['id'], $ip]
+            );
+            if (!$seen) {
+                Notifier::loginNewIp($user['email'], $ip);
+            }
+        } catch (\Exception $e) { /* nie blockierend */ }
+    }
+
+    /** Liegt ein Login vor, der noch auf den 2FA-Code wartet? */
+    public function isTotpPending() {
+        return isset($_SESSION['totp_pending_user_id'])
+            && isset($_SESSION['totp_pending_time'])
+            && (time() - (int)$_SESSION['totp_pending_time']) < 300; // 5 Min Fenster
+    }
+
+    /** Schliesst einen 2FA-Login mit dem eingegebenen Code ab. */
+    public function verifyTotpLogin($code) {
+        if (!$this->isTotpPending()) {
+            return false;
+        }
+        $user = $this->db->fetchOne(
+            "SELECT * FROM users WHERE id = ? AND is_active = 1",
+            [$_SESSION['totp_pending_user_id']]
+        );
+        if (!$user || empty($user['totp_secret'])) {
+            unset($_SESSION['totp_pending_user_id'], $_SESSION['totp_pending_time']);
+            return false;
+        }
+        // Entweder gueltiger TOTP-Code ODER ein Recovery-/Backup-Code
+        // (Secret wird verschluesselt gespeichert; Klartext-Fallback via decrypt)
+        $ok = Totp::verify(Crypto::decrypt($user['totp_secret']), $code);
+        if (!$ok && $this->consumeBackupCode($user, $code)) {
+            $ok = true;
+            $this->writeAuditLog($user['id'], 'user_login_backup_code', 'user', $user['id'], 'Login per Recovery-Code');
+        }
+        if (!$ok) {
+            $this->writeAuditLog($user['id'], 'user_login_2fa_failed', 'user', $user['id'], '2FA-Code falsch');
+            return false;
+        }
+        unset($_SESSION['totp_pending_user_id'], $_SESSION['totp_pending_time']);
+        $this->notifyIfNewIp($user, $this->clientIp());
+        $this->setUserSession($user);
+        $this->updateLastLogin($user['id']);
+        $this->writeAuditLog($user['id'], 'user_login', 'user', $user['id'], 'Login erfolgreich (2FA)');
+        return true;
+    }
+
+    /**
+     * 2FA fuer einen Benutzer aktivieren und Recovery-Codes erzeugen.
+     * @return array Klartext-Recovery-Codes (nur hier einmalig verfuegbar)
+     */
+    public function enableTotp($userId, $secret) {
+        $codes = $this->generateBackupCodes();
+        $hashes = array_map(function ($c) { return hash('sha256', $c); }, $codes);
+        $this->db->query(
+            "UPDATE users SET totp_secret = ?, totp_enabled = 1, totp_backup_codes = ? WHERE id = ?",
+            [Crypto::encrypt($secret), json_encode($hashes), $userId]
+        );
+        $this->writeAuditLog($userId, 'totp_enabled', 'user', $userId, '2FA aktiviert');
+        return $codes;
+    }
+
+    /** 2FA fuer einen Benutzer deaktivieren. */
+    public function disableTotp($userId) {
+        $this->db->query(
+            "UPDATE users SET totp_secret = NULL, totp_enabled = 0, totp_backup_codes = NULL WHERE id = ?",
+            [$userId]
+        );
+        $this->writeAuditLog($userId, 'totp_disabled', 'user', $userId, '2FA deaktiviert');
+    }
+
+    /** Neue Recovery-Codes erzeugen (8 Stueck, Format XXXX-XXXX). */
+    public function generateBackupCodes($count = 8) {
+        $codes = [];
+        for ($i = 0; $i < $count; $i++) {
+            $raw = strtoupper(bin2hex(random_bytes(4))); // 8 Hex-Zeichen
+            $codes[] = substr($raw, 0, 4) . '-' . substr($raw, 4, 4);
+        }
+        return $codes;
+    }
+
+    /** Recovery-Codes neu erzeugen und speichern; gibt Klartext zurueck. */
+    public function regenerateBackupCodes($userId) {
+        $codes = $this->generateBackupCodes();
+        $hashes = array_map(function ($c) { return hash('sha256', $c); }, $codes);
+        $this->db->query("UPDATE users SET totp_backup_codes = ? WHERE id = ?", [json_encode($hashes), $userId]);
+        $this->writeAuditLog($userId, 'totp_backup_regenerated', 'user', $userId, 'Recovery-Codes neu erzeugt');
+        return $codes;
+    }
+
+    /** Anzahl noch nicht verbrauchter Recovery-Codes. */
+    public function backupCodesRemaining($user) {
+        $list = json_decode($user['totp_backup_codes'] ?? '[]', true);
+        return is_array($list) ? count($list) : 0;
+    }
+
+    /** Prueft & verbraucht einen Recovery-Code (konstante Zeit). */
+    private function consumeBackupCode($user, $code) {
+        $code = strtoupper(trim($code));
+        $list = json_decode($user['totp_backup_codes'] ?? '[]', true);
+        if (!is_array($list) || empty($list)) {
+            return false;
+        }
+        $hash = hash('sha256', $code);
+        $matched = false;
+        $remaining = [];
+        foreach ($list as $h) {
+            if (!$matched && hash_equals($h, $hash)) {
+                $matched = true; // diesen verbrauchen (nicht behalten)
+            } else {
+                $remaining[] = $h;
+            }
+        }
+        if ($matched) {
+            $this->db->query("UPDATE users SET totp_backup_codes = ? WHERE id = ?", [json_encode($remaining), $user['id']]);
+        }
+        return $matched;
+    }
+
    public function writeAuditLog($userId, $action, $entityType = null, $entityId = null, $details = null) {
        try {
            $this->db->execute(
                "INSERT INTO audit_log (user_id, action, entity_type, entity_id, details, ip_address) VALUES (?, ?, ?, ?, ?, ?)",
-                [$userId, $action, $entityType, $entityId !== null ? (string)$entityId : null, $details, $_SERVER['REMOTE_ADDR'] ?? '']
+                [$userId, $action, $entityType, $entityId !== null ? (string)$entityId : null, $details, $this->clientIp()]
            );
        } catch (\Exception $e) {
            // audit_log table may not exist on old installs
@ -256,6 +427,45 @@ class Auth {
            header('Location: /index.php?error=access_denied');
            exit;
        }
+        // Optionale Richtlinie: 2FA fuer Admins erzwingen. Admins ohne aktives
+        // 2FA werden zur Einrichtung umgeleitet (security.php nutzt requireLogin,
+        // daher keine Endlosschleife).
+        try {
+            if ((string)$this->db->getSetting('enforce_2fa_admins', '0') === '1') {
+                $user = $this->getCurrentUser();
+                $script = basename($_SERVER['SCRIPT_NAME'] ?? '');
+                if ($user && !empty($user['password_hash']) && empty($user['totp_enabled'])
+                    && $script !== 'security.php') {
+                    header('Location: security.php?setup_required=1');
+                    exit;
+                }
+            }
+        } catch (\Exception $e) { /* Richtlinie nie blockierend */ }
+    }
+    
+    /** Anzahl aktiver (nicht abgelaufener) DB-Sessions des aktuellen Nutzers. */
+    public function activeSessionCount() {
+        if (!$this->isLoggedIn()) return 0;
+        try {
+            $r = $this->db->fetchOne(
+                "SELECT COUNT(*) c FROM sessions WHERE user_id = ? AND expires_at > NOW()",
+                [$_SESSION['user_id']]
+            );
+            return (int)($r['c'] ?? 0);
+        } catch (\Exception $e) { return 0; }
+    }
+
+    /** Alle anderen Sessions des Nutzers beenden ("überall abmelden"). */
+    public function logoutOtherSessions() {
+        if (!$this->isLoggedIn()) return;
+        try {
+            $current = session_id();
+            $this->db->query(
+                "DELETE FROM sessions WHERE user_id = ? AND id != ?",
+                [$_SESSION['user_id'], $current]
+            );
+            $this->writeAuditLog($_SESSION['user_id'], 'logout_other_sessions', 'user', $_SESSION['user_id'], 'Andere Sessions beendet');
+        } catch (\Exception $e) { /* nur bei DB-Sessions wirksam */ }
    }

    // Login erforderlich
--- a/includes/Captcha.php
+++ b/includes/Captcha.php
@ -0,0 +1,56 @@
+<?php
+/**
+ * Captcha – Schutz der öffentlichen (anonymen) Voucher-Erstellung.
+ *
+ * Modi (Setting captcha_mode):
+ *   'off'      – deaktiviert
+ *   'math'     – selbst-enthaltenes Rechen-Captcha (keine externen Dienste)
+ *   'hcaptcha' – hCaptcha (Setting captcha_site_key / captcha_secret)
+ *
+ * Reine PHP-Standardlib + cURL (für hCaptcha-Verifizierung).
+ */
+class Captcha {
+    public static function mode($db) {
+        $m = (string)$db->getSetting('captcha_mode', 'off');
+        return in_array($m, ['off', 'math', 'hcaptcha'], true) ? $m : 'off';
+    }
+
+    /** Frage für das Math-Captcha erzeugen und Antwort in Session hinterlegen. */
+    public static function newMathChallenge() {
+        $a = random_int(1, 9);
+        $b = random_int(1, 9);
+        $_SESSION['captcha_answer'] = (string)($a + $b);
+        return "$a + $b";
+    }
+
+    /** Prüft die Captcha-Antwort des aktuellen Requests. */
+    public static function verify($db) {
+        $mode = self::mode($db);
+        if ($mode === 'off') {
+            return true;
+        }
+        if ($mode === 'math') {
+            $expected = $_SESSION['captcha_answer'] ?? null;
+            unset($_SESSION['captcha_answer']); // einmalig
+            $given = trim((string)($_POST['captcha'] ?? ''));
+            return $expected !== null && hash_equals((string)$expected, $given);
+        }
+        if ($mode === 'hcaptcha') {
+            $resp = $_POST['h-captcha-response'] ?? '';
+            if ($resp === '') return false;
+            $secret = (string)$db->getSetting('captcha_secret', '');
+            $ch = curl_init('https://hcaptcha.com/siteverify');
+            curl_setopt_array($ch, [
+                CURLOPT_POST => true,
+                CURLOPT_POSTFIELDS => http_build_query(['secret' => $secret, 'response' => $resp]),
+                CURLOPT_RETURNTRANSFER => true,
+                CURLOPT_TIMEOUT => 8,
+            ]);
+            $out = curl_exec($ch);
+            curl_close($ch);
+            $data = json_decode((string)$out, true);
+            return is_array($data) && !empty($data['success']);
+        }
+        return true;
+    }
+}
--- a/includes/DbSessionHandler.php
+++ b/includes/DbSessionHandler.php
@ -0,0 +1,75 @@
+<?php
+/**
+ * DbSessionHandler – speichert PHP-Sessions in der `sessions`-Tabelle.
+ *
+ * Opt-in über Setting `session_driver = db` (Standard 'php' = unverändert).
+ * Ermöglicht "überall abmelden" und eine Übersicht aktiver Sessions.
+ *
+ * Alle DB-Operationen sind fehlertolerant gekapselt – schlägt etwas fehl,
+ * degradiert die Session still, statt die Anwendung lahmzulegen.
+ */
+class DbSessionHandler implements SessionHandlerInterface
+{
+    private $db;
+    private $ttl;
+
+    public function __construct($db, $ttl = 3600)
+    {
+        $this->db = $db;
+        $this->ttl = max(300, (int)$ttl);
+    }
+
+    #[\ReturnTypeWillChange]
+    public function open($path, $name) { return true; }
+
+    #[\ReturnTypeWillChange]
+    public function close() { return true; }
+
+    #[\ReturnTypeWillChange]
+    public function read($id)
+    {
+        try {
+            $row = $this->db->fetchOne(
+                "SELECT data FROM sessions WHERE id = ? AND expires_at > NOW()", [$id]
+            );
+            return $row && $row['data'] !== null ? (string)$row['data'] : '';
+        } catch (\Throwable $e) {
+            return '';
+        }
+    }
+
+    #[\ReturnTypeWillChange]
+    public function write($id, $data)
+    {
+        try {
+            $uid = isset($_SESSION['user_id']) ? (int)$_SESSION['user_id'] : null;
+            $expires = date('Y-m-d H:i:s', time() + $this->ttl);
+            $this->db->query(
+                "INSERT INTO sessions (id, user_id, data, expires_at) VALUES (?, ?, ?, ?)
+                 ON DUPLICATE KEY UPDATE user_id = VALUES(user_id), data = VALUES(data), expires_at = VALUES(expires_at)",
+                [$id, $uid, $data, $expires]
+            );
+        } catch (\Throwable $e) {
+            // still ignorieren
+        }
+        return true;
+    }
+
+    #[\ReturnTypeWillChange]
+    public function destroy($id)
+    {
+        try {
+            $this->db->query("DELETE FROM sessions WHERE id = ?", [$id]);
+        } catch (\Throwable $e) {}
+        return true;
+    }
+
+    #[\ReturnTypeWillChange]
+    public function gc($max_lifetime)
+    {
+        try {
+            $this->db->query("DELETE FROM sessions WHERE expires_at < NOW()");
+        } catch (\Throwable $e) {}
+        return true;
+    }
+}
--- a/includes/Mailer.php
+++ b/includes/Mailer.php
@ -31,12 +31,23 @@ class Mailer {
    }

    public function send($to, $subject, $body, $isHtml = false) {
+        // Bis zu 2 Versuche bei vorübergehenden Zustellfehlern (Retry).
+        $attempts = 2;
+        for ($i = 1; $i <= $attempts; $i++) {
            if (!$this->smtpEnabled || empty($this->smtpHost)) {
-            // Fallback auf PHP mail()
-            return $this->sendWithPhpMail($to, $subject, $body);
+                $ok = $this->sendWithPhpMail($to, $subject, $body);
+            } else {
+                $ok = $this->sendWithSmtp($to, $subject, $body, $isHtml);
            }
-        
-        return $this->sendWithSmtp($to, $subject, $body, $isHtml);
+            if ($ok) {
+                return true;
+            }
+            if ($i < $attempts) {
+                usleep(500000); // 0,5s vor erneutem Versuch
+            }
+        }
+        error_log("Mailer: Zustellung an {$to} nach {$attempts} Versuchen fehlgeschlagen.");
+        return false;
    }
    
    private function sendWithPhpMail($to, $subject, $body) {
--- a/includes/Notifier.php
+++ b/includes/Notifier.php
@ -0,0 +1,71 @@
+<?php
+/**
+ * Notifier – sendet Ereignis-Benachrichtigungen an einen konfigurierten
+ * Webhook (Slack / Microsoft Teams / generischer JSON-Endpunkt).
+ *
+ * Gesteuert über Einstellungen:
+ *   webhook_enabled (0/1), webhook_url
+ *
+ * Sendet ein Slack/Teams-kompatibles { "text": "..." }-Payload plus ein
+ * strukturiertes "event"-Feld. Fehler werden still ignoriert – eine
+ * Benachrichtigung darf nie den eigentlichen Vorgang blockieren.
+ */
+class Notifier {
+    /** Generisches Event senden. */
+    public static function send($text, array $data = []) {
+        try {
+            $db = Database::getInstance();
+            if ((string)$db->getSetting('webhook_enabled', '0') !== '1') {
+                return;
+            }
+            $url = trim((string)$db->getSetting('webhook_url', ''));
+            if ($url === '' || !filter_var($url, FILTER_VALIDATE_URL)) {
+                return;
+            }
+        } catch (\Exception $e) {
+            return;
+        }
+
+        $payload = json_encode(array_merge(['text' => $text], $data ? ['event' => $data] : []));
+
+        $ch = curl_init($url);
+        curl_setopt_array($ch, [
+            CURLOPT_POST           => true,
+            CURLOPT_POSTFIELDS     => $payload,
+            CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT        => 5,
+            CURLOPT_CONNECTTIMEOUT => 3,
+        ]);
+        @curl_exec($ch);
+        curl_close($ch);
+    }
+
+    /** Controller nicht erreichbar (z.B. beim Sync). */
+    public static function controllerUnreachable($siteName, $detail = '') {
+        self::send("⚠️ UniFi-Controller für \"{$siteName}\" nicht erreichbar." . ($detail ? " ({$detail})" : ''),
+            ['type' => 'controller_unreachable', 'site' => $siteName, 'detail' => $detail]);
+    }
+
+    /** Anmeldung von einer bisher unbekannten IP. */
+    public static function loginNewIp($email, $ip) {
+        self::send("🔐 Neue Anmeldung für {$email} von IP {$ip}.",
+            ['type' => 'login_new_ip', 'email' => $email, 'ip' => $ip]);
+    }
+
+    /** Update verfügbar. */
+    public static function updateAvailable($sha) {
+        self::send("⬆️ Update verfügbar (" . substr((string)$sha, 0, 7) . "). Siehe Administration → System-Update.",
+            ['type' => 'update_available', 'sha' => $sha]);
+    }
+
+    /** Bequemer Helfer für erstellte Voucher. */
+    public static function voucherCreated($count, $siteName, $byUser = null) {
+        $who = $byUser ? " von {$byUser}" : '';
+        $what = $count > 1 ? "{$count} Voucher" : 'Ein Voucher';
+        self::send(
+            "🎫 {$what} für \"{$siteName}\"{$who} erstellt.",
+            ['type' => 'voucher_created', 'count' => $count, 'site' => $siteName, 'user' => $byUser]
+        );
+    }
+}
--- a/includes/Sms.php
+++ b/includes/Sms.php
@ -0,0 +1,42 @@
+<?php
+/**
+ * Sms – Versand von Voucher-Codes per SMS über Twilio.
+ *
+ * Settings: sms_enabled (0/1), twilio_sid, twilio_token, twilio_from
+ * Reine PHP-Standardlib + cURL. Fehler werden geloggt, nie geworfen.
+ */
+class Sms {
+    public static function enabled($db) {
+        return (string)$db->getSetting('sms_enabled', '0') === '1'
+            && $db->getSetting('twilio_sid', '') !== ''
+            && $db->getSetting('twilio_token', '') !== ''
+            && $db->getSetting('twilio_from', '') !== '';
+    }
+
+    /** Sendet eine SMS. Gibt true bei Erfolg zurück. */
+    public static function send($db, $to, $text) {
+        if (!self::enabled($db)) {
+            return false;
+        }
+        $sid   = (string)$db->getSetting('twilio_sid', '');
+        $token = (string)$db->getSetting('twilio_token', '');
+        $from  = (string)$db->getSetting('twilio_from', '');
+
+        $ch = curl_init("https://api.twilio.com/2010-04-01/Accounts/" . rawurlencode($sid) . "/Messages.json");
+        curl_setopt_array($ch, [
+            CURLOPT_POST => true,
+            CURLOPT_USERPWD => $sid . ':' . $token,
+            CURLOPT_POSTFIELDS => http_build_query(['From' => $from, 'To' => $to, 'Body' => $text]),
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT => 10,
+        ]);
+        $out  = curl_exec($ch);
+        $code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+        curl_close($ch);
+        if ($code >= 200 && $code < 300) {
+            return true;
+        }
+        error_log("Sms(Twilio) Fehler HTTP $code: " . substr((string)$out, 0, 200));
+        return false;
+    }
+}
--- a/includes/Totp.php
+++ b/includes/Totp.php
@ -0,0 +1,83 @@
+<?php
+/**
+ * Totp – minimaler TOTP-Generator/-Validator nach RFC 6238 (HMAC-SHA1,
+ * 6 Stellen, 30s-Zeitfenster). Reine PHP-Standardlib, keine Abhaengigkeiten.
+ * Kompatibel mit Google Authenticator, Authy, Microsoft Authenticator etc.
+ */
+class Totp {
+    private const DIGITS = 6;
+    private const PERIOD = 30;
+    private const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+
+    /** Erzeugt ein neues Base32-Secret (Standard 16 Zeichen = 80 bit). */
+    public static function generateSecret($length = 16) {
+        $secret = '';
+        $bytes = random_bytes($length);
+        for ($i = 0; $i < $length; $i++) {
+            $secret .= self::BASE32[ord($bytes[$i]) & 31];
+        }
+        return $secret;
+    }
+
+    /** Aktueller Code fuer ein Secret. */
+    public static function code($secret, $timeSlice = null) {
+        if ($timeSlice === null) {
+            $timeSlice = (int) floor(time() / self::PERIOD);
+        }
+        $key = self::base32Decode($secret);
+        // 8-Byte Big-Endian Counter
+        $binTime = pack('N*', 0) . pack('N*', $timeSlice);
+        $hash = hash_hmac('sha1', $binTime, $key, true);
+        $offset = ord($hash[strlen($hash) - 1]) & 0x0F;
+        $part = substr($hash, $offset, 4);
+        $value = unpack('N', $part)[1] & 0x7FFFFFFF;
+        $mod = $value % (10 ** self::DIGITS);
+        return str_pad((string)$mod, self::DIGITS, '0', STR_PAD_LEFT);
+    }
+
+    /**
+     * Prueft einen Code mit Toleranzfenster (+/- $window Zeitschritte gegen
+     * Uhren-Drift). Konstante-Zeit-Vergleich gegen Timing-Angriffe.
+     */
+    public static function verify($secret, $code, $window = 1) {
+        if (!preg_match('/^\d{6}$/', (string)$code)) {
+            return false;
+        }
+        $current = (int) floor(time() / self::PERIOD);
+        for ($i = -$window; $i <= $window; $i++) {
+            if (hash_equals(self::code($secret, $current + $i), (string)$code)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /** otpauth://-URI fuer QR-Code-Provisionierung. */
+    public static function provisioningUri($secret, $accountName, $issuer) {
+        $label = rawurlencode($issuer . ':' . $accountName);
+        $params = http_build_query([
+            'secret' => $secret,
+            'issuer' => $issuer,
+            'algorithm' => 'SHA1',
+            'digits' => self::DIGITS,
+            'period' => self::PERIOD,
+        ]);
+        return "otpauth://totp/$label?$params";
+    }
+
+    private static function base32Decode($b32) {
+        $b32 = strtoupper(rtrim($b32, '='));
+        $buffer = 0; $bitsLeft = 0; $out = '';
+        for ($i = 0; $i < strlen($b32); $i++) {
+            $val = strpos(self::BASE32, $b32[$i]);
+            if ($val === false) continue;
+            $buffer = ($buffer << 5) | $val;
+            $bitsLeft += 5;
+            if ($bitsLeft >= 8) {
+                $bitsLeft -= 8;
+                $out .= chr(($buffer >> $bitsLeft) & 0xFF);
+            }
+        }
+        return $out;
+    }
+}
--- a/includes/UniFiController.php
+++ b/includes/UniFiController.php
@ -156,7 +156,8 @@ class UniFiController {
    }
    
    // Voucher erstellen
-    public function createVoucher($voucherName, $maxUses, $expireMinutes = 480) {
+    // $options: optionale QoS-Limits ['down' => kbps, 'up' => kbps, 'quota_mb' => MB]
+    public function createVoucher($voucherName, $maxUses, $expireMinutes = 480, $options = []) {
        $data = [
            'cmd' => 'create-voucher',
            'expire' => (int)$expireMinutes,
@ -165,6 +166,17 @@ class UniFiController {
            'quota' => (int)$maxUses
        ];

+        // Bandbreiten-/Datenlimits (UniFi QoS) optional setzen
+        $down  = isset($options['down'])     ? (int)$options['down']     : 0;
+        $up    = isset($options['up'])       ? (int)$options['up']       : 0;
+        $bytes = isset($options['quota_mb']) ? (int)$options['quota_mb'] : 0;
+        if ($down > 0 || $up > 0 || $bytes > 0) {
+            $data['qos_overwrite'] = true;
+            if ($down > 0)  $data['down']  = $down;   // kbit/s
+            if ($up > 0)    $data['up']    = $up;     // kbit/s
+            if ($bytes > 0) $data['bytes'] = $bytes;  // Megabyte
+        }
+
        $response = $this->apiRequest("/proxy/network/api/s/{$this->siteId}/cmd/hotspot", $data);

        if (!isset($response['data'][0]['create_time'])) {
--- a/includes/admin_nav.php
+++ b/includes/admin_nav.php
@ -110,9 +110,27 @@ $lang        = I18n::getLanguage();
            <li><a href="<?= $adminBase ?? '' ?>audit_log.php" class="<?= $currentPage === 'audit_log' ? 'active' : '' ?>">
                <i class="fas fa-history"></i> <?= __('nav_audit_log') ?>
            </a></li>
+            <li><a href="<?= $adminBase ?? '' ?>reports.php" class="<?= $currentPage === 'reports' ? 'active' : '' ?>">
+                <i class="fas fa-chart-line"></i> <?= __('nav_reports') ?>
+            </a></li>
+            <li><a href="<?= $adminBase ?? '' ?>import.php" class="<?= $currentPage === 'import' ? 'active' : '' ?>">
+                <i class="fas fa-file-import"></i> <?= __('nav_import') ?>
+            </a></li>
            <li><a href="<?= $adminBase ?? '' ?>settings.php" class="<?= $currentPage === 'settings' ? 'active' : '' ?>">
                <i class="fas fa-cog"></i> <?= __('nav_settings') ?>
            </a></li>
+            <li><a href="<?= $adminBase ?? '' ?>api_keys.php" class="<?= $currentPage === 'api_keys' ? 'active' : '' ?>">
+                <i class="fas fa-key"></i> <?= __('nav_api_keys') ?>
+            </a></li>
+            <li><a href="<?= $adminBase ?? '' ?>security.php" class="<?= $currentPage === 'security' ? 'active' : '' ?>">
+                <i class="fas fa-user-shield"></i> <?= __('nav_security') ?>
+            </a></li>
+            <li><a href="<?= $adminBase ?? '' ?>integrations.php" class="<?= $currentPage === 'integrations' ? 'active' : '' ?>">
+                <i class="fas fa-plug"></i> <?= __('nav_integrations') ?>
+            </a></li>
+            <li><a href="<?= $adminBase ?? '' ?>backup.php" class="<?= $currentPage === 'backup' ? 'active' : '' ?>">
+                <i class="fas fa-database"></i> <?= __('nav_backup') ?>
+            </a></li>
            <li><a href="<?= $adminBase ?? '' ?>update.php" class="<?= $currentPage === 'update' ? 'active' : '' ?>">
                <i class="fas fa-sync-alt"></i> <?= __('nav_update') ?>
            </a></li>
--- a/index.php
+++ b/index.php
@ -16,6 +16,9 @@ require_once __DIR__ . '/includes/Database.php';
 require_once __DIR__ . '/includes/Auth.php';
 require_once __DIR__ . '/includes/UniFiController.php';
 require_once __DIR__ . '/includes/Mailer.php';
+require_once __DIR__ . '/includes/Notifier.php';
+require_once __DIR__ . '/includes/Captcha.php';
+require_once __DIR__ . '/includes/Sms.php';
 require_once __DIR__ . '/includes/I18n.php';

 $auth = new Auth();
@ -45,6 +48,26 @@ function isVoucherRateLimited() {
    return false;
 }

+/**
+ * Optionales Tageslimit pro (Nicht-Admin-)Benutzer (Setting
+ * user_daily_voucher_limit, 0 = aus). Verhindert übermäßige Erstellung.
+ */
+function userDailyLimitExceeded($db, $auth, $additional = 1) {
+    if (!$auth->isLoggedIn() || $auth->isAdmin()) {
+        return false;
+    }
+    $limit = (int)$db->getSetting('user_daily_voucher_limit', 0);
+    if ($limit <= 0) {
+        return false;
+    }
+    $uid = $_SESSION['user_id'] ?? 0;
+    $today = (int)($db->fetchOne(
+        "SELECT COUNT(*) c FROM vouchers WHERE user_id=? AND DATE(created_at)=CURDATE()",
+        [$uid]
+    )['c'] ?? 0);
+    return ($today + $additional) > $limit;
+}
+
 $appTitle          = $db->getSetting('app_title', 'UniFi Voucher System');
 $logoUrl           = $db->getSetting('logo_url', '');
 $instructionHeader = $db->getSetting('instruction_header', '');
@ -92,7 +115,7 @@ if ($auth->isLoggedIn()) {
 $autoSelectSite = (count($sites) === 1) ? $sites[0]['id'] : 0;

 // Helper: create one voucher and save to DB
-function doCreateVoucher($db, $site, $voucherName, $maxUses, $expireMinutes, $userId) {
+function doCreateVoucher($db, $site, $voucherName, $maxUses, $expireMinutes, $userId, $qos = []) {
    $datum          = date('Y-m-d');
    $fullName       = $datum . '_' . $voucherName;
    $controller     = new UniFiController(
@ -101,7 +124,7 @@ function doCreateVoucher($db, $site, $voucherName, $maxUses, $expireMinutes, $us
        Crypto::decrypt($site['unifi_password']),
        $site['site_id']
    );
-    $voucher = $controller->createVoucher($fullName, $maxUses, $expireMinutes);
+    $voucher = $controller->createVoucher($fullName, $maxUses, $expireMinutes, $qos);
    if (!is_array($voucher) || empty($voucher['formatted_code'])) {
        throw new Exception(__('error_voucher_invalid'));
    }
@ -130,6 +153,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_voucher'])) {
        $error = __('error_csrf');
    } elseif (!$auth->isLoggedIn() && isVoucherRateLimited()) {
        $error = 'Zu viele Anfragen. Bitte warten Sie einen Moment.';
+    } elseif (!$auth->isLoggedIn() && !Captcha::verify($db)) {
+        $error = 'Captcha-Prüfung fehlgeschlagen. Bitte erneut versuchen.';
    } else {
        try {
            $siteId        = (int)($_POST['site_id'] ?? 0);
@ -145,20 +170,32 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_voucher'])) {
            if ($sendEmail && !filter_var($recipientEmail, FILTER_VALIDATE_EMAIL)) throw new Exception(__('error_email_invalid'));

            if ($auth->isLoggedIn() && !$auth->hasAccessToSite($siteId)) throw new Exception(__('error_site_no_perm'));
+            if (userDailyLimitExceeded($db, $auth, 1)) throw new Exception('Tageslimit für Voucher erreicht.');

            $site = $db->fetchOne("SELECT * FROM sites WHERE id = ? AND is_active = 1", [$siteId]);
            if (!$site) throw new Exception(__('error_site_not_found'));

            $userId  = $auth->isLoggedIn() ? ($_SESSION['user_id'] ?? null) : null;
-            $voucherData = doCreateVoucher($db, $site, $voucherName, $maxUses, $expireMinutes, $userId);
+            $qos = [
+                'down'     => max(0, (int)($_POST['qos_down'] ?? 0)),
+                'up'       => max(0, (int)($_POST['qos_up'] ?? 0)),
+                'quota_mb' => max(0, (int)($_POST['qos_quota'] ?? 0)),
+            ];
+            $voucherData = doCreateVoucher($db, $site, $voucherName, $maxUses, $expireMinutes, $userId, $qos);
            $voucherCode  = $voucherData['code'];
            $voucherCreated = true;
+            Notifier::voucherCreated(1, $site['name'], $_SESSION['user_name'] ?? null);

+            $success = 'Voucher erfolgreich erstellt!';
            if ($sendEmail && !empty($recipientEmail)) {
                $mailer->sendVoucherEmail($recipientEmail, $voucherCode, $site['name'], $maxUses);
-                $success = 'Voucher erstellt. E-Mail versendet.';
-            } else {
-                $success = 'Voucher erfolgreich erstellt!';
+                $success .= ' E-Mail versendet.';
+            }
+            // Optional: Code per SMS (Twilio)
+            $recipientPhone = trim((string)($_POST['recipient_phone'] ?? ''));
+            if (isset($_POST['send_sms']) && $recipientPhone !== '' && Sms::enabled($db)) {
+                $smsText = ($appTitle ? $appTitle . ': ' : '') . 'WLAN-Code ' . $voucherCode;
+                $success .= Sms::send($db, $recipientPhone, $smsText) ? ' SMS versendet.' : ' (SMS fehlgeschlagen)';
            }
        } catch (Exception $e) {
            $error = 'Fehler: ' . $e->getMessage();
@ -175,6 +212,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_bulk'])) {
        $error = __('error_csrf');
    } elseif (!$auth->isLoggedIn() && isVoucherRateLimited()) {
        $error = 'Zu viele Anfragen. Bitte warten Sie einen Moment.';
+    } elseif (!$auth->isLoggedIn() && !Captcha::verify($db)) {
+        $error = 'Captcha-Prüfung fehlgeschlagen. Bitte erneut versuchen.';
    } else {
        try {
            $siteId        = (int)($_POST['site_id'] ?? 0);
@ -187,16 +226,23 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_bulk'])) {
            if ($maxUses < 1 || $maxUses > $maxUsesLimit) throw new Exception(__('error_devices_range', ['max' => $maxUsesLimit]));
            if ($siteId <= 0) throw new Exception(__('error_site_req'));
            if ($auth->isLoggedIn() && !$auth->hasAccessToSite($siteId)) throw new Exception(__('error_site_no_perm'));
+            if (userDailyLimitExceeded($db, $auth, $bulkCount)) throw new Exception('Tageslimit für Voucher erreicht.');

            $site = $db->fetchOne("SELECT * FROM sites WHERE id = ? AND is_active = 1", [$siteId]);
            if (!$site) throw new Exception(__('error_site_not_found'));

            $userId = $auth->isLoggedIn() ? ($_SESSION['user_id'] ?? null) : null;
+            $qos = [
+                'down'     => max(0, (int)($_POST['qos_down'] ?? 0)),
+                'up'       => max(0, (int)($_POST['qos_up'] ?? 0)),
+                'quota_mb' => max(0, (int)($_POST['qos_quota'] ?? 0)),
+            ];

            for ($i = 0; $i < $bulkCount; $i++) {
-                $bulkVouchers[] = doCreateVoucher($db, $site, $voucherName . '_' . ($i + 1), $maxUses, $expireMinutes, $userId);
+                $bulkVouchers[] = doCreateVoucher($db, $site, $voucherName . '_' . ($i + 1), $maxUses, $expireMinutes, $userId, $qos);
            }

+            Notifier::voucherCreated($bulkCount, $site['name'], $_SESSION['user_name'] ?? null);
            $bulkCreated = true;
            $success = str_replace('{count}', $bulkCount, __('bulk_success'));
        } catch (Exception $e) {
@ -207,6 +253,19 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_bulk'])) {

 $currentUser = $auth->isLoggedIn() ? $auth->getCurrentUser() : null;

+// Captcha nur für anonyme öffentliche Erstellung
+$captchaMode     = !$auth->isLoggedIn() ? Captcha::mode($db) : 'off';
+$captchaQuestion = $captchaMode === 'math' ? Captcha::newMathChallenge() : '';
+$hcaptchaSiteKey = $captchaMode === 'hcaptcha' ? $db->getSetting('captcha_site_key', '') : '';
+$smsEnabled = Sms::enabled($db);
+$captchaHtml = '';
+if ($captchaMode === 'math') {
+    $captchaHtml = '<div class="form-group"><label>Sicherheitsfrage: Wie viel ist ' . htmlspecialchars($captchaQuestion) . '?</label>'
+        . '<input type="text" name="captcha" inputmode="numeric" required></div>';
+} elseif ($captchaMode === 'hcaptcha' && $hcaptchaSiteKey !== '') {
+    $captchaHtml = '<div class="form-group"><div class="h-captcha" data-sitekey="' . htmlspecialchars($hcaptchaSiteKey) . '"></div></div>';
+}
+
 // Build print HTML for each voucher
 function buildPrintCard($template, $data, $instructionHeader, $instructionText, $appTitle) {
    $instructions = $instructionHeader || $instructionText
@ -226,6 +285,9 @@ function buildPrintCard($template, $data, $instructionHeader, $instructionText,
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?= htmlspecialchars($appTitle) ?></title>
    <link rel="stylesheet" href="assets/global.css">
+    <?php if ($captchaMode === 'hcaptcha' && $hcaptchaSiteKey !== ''): ?>
+    <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+    <?php endif; ?>
    <script>(function(){ const t=localStorage.getItem('theme')||'light'; document.documentElement.setAttribute('data-theme',t); })();</script>
    <?php if ($voucherCreated): ?>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js" integrity="sha512-CNgIRecGo7nphbeZ04Sc13ka07paqdeTu0WR1IM4kNcpmBAUSHSe2keRB6Q5pBUtIxCY7bQMsVB0ANBpd6JDg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
@ -452,6 +514,9 @@ function buildPrintCard($template, $data, $instructionHeader, $instructionText,
                <option value="<?= (int)$tpl['id'] ?>"
                        data-max-uses="<?= (int)$tpl['max_uses'] ?>"
                        data-expire="<?= (int)$tpl['expire_minutes'] ?>"
+                        data-qos-down="<?= (int)($tpl['qos_rate_max_down'] ?? 0) ?>"
+                        data-qos-up="<?= (int)($tpl['qos_rate_max_up'] ?? 0) ?>"
+                        data-qos-quota="<?= (int)($tpl['qos_usage_quota'] ?? 0) ?>"
                        data-desc="<?= htmlspecialchars($tpl['description'] ?? '') ?>">
                    <?= htmlspecialchars($tpl['name']) ?> –
                    <?= (int)$tpl['max_uses'] ?> <?= __('label_devices') ?>,
@ -469,6 +534,10 @@ function buildPrintCard($template, $data, $instructionHeader, $instructionText,
                <input type="hidden" name="create_voucher" value="1">
                <input type="hidden" name="expire_minutes" id="expire_minutes" value="<?= $defaultExpire ?>">
                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($auth->getCsrfToken()) ?>">
+                <input type="hidden" name="qos_down" class="qos-down-field" value="0">
+                <input type="hidden" name="qos_up" class="qos-up-field" value="0">
+                <input type="hidden" name="qos_quota" class="qos-quota-field" value="0">
+                <?= $captchaHtml ?>

                <div class="form-group">
                    <label for="voucher_name"><?= __('voucher_name_label') ?></label>
@ -514,6 +583,19 @@ function buildPrintCard($template, $data, $instructionHeader, $instructionText,
                </div>
                <?php endif; ?>

+                <?php if ($smsEnabled): ?>
+                <div class="email-option">
+                    <div class="email-checkbox-wrapper">
+                        <input type="checkbox" id="send_sms" name="send_sms" onchange="document.getElementById('sms_field').style.display=this.checked?'block':'none'">
+                        <label for="send_sms">📱 Code per SMS versenden</label>
+                    </div>
+                    <div id="sms_field" style="display:none;margin-top:12px;">
+                        <label for="recipient_phone">Telefonnummer (international, z.B. +49170…)</label>
+                        <input type="tel" id="recipient_phone" name="recipient_phone" placeholder="+49170123456">
+                    </div>
+                </div>
+                <?php endif; ?>
+
                <button type="submit" class="btn" id="submitBtn">
                    <?= __('voucher_create_btn') ?>
                </button>
@ -526,6 +608,10 @@ function buildPrintCard($template, $data, $instructionHeader, $instructionText,
                <input type="hidden" name="create_bulk" value="1">
                <input type="hidden" name="expire_minutes" id="bulk_expire_minutes" value="<?= $defaultExpire ?>">
                <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($auth->getCsrfToken()) ?>">
+                <input type="hidden" name="qos_down" class="qos-down-field" value="0">
+                <input type="hidden" name="qos_up" class="qos-up-field" value="0">
+                <input type="hidden" name="qos_quota" class="qos-quota-field" value="0">
+                <?= $captchaHtml ?>

                <div class="form-group">
                    <label for="bulk_count"><?= __('bulk_quantity') ?></label>
@ -631,6 +717,13 @@ function buildPrintCard($template, $data, $instructionHeader, $instructionText,
        const bmuEl = document.getElementById('bulk_max_uses');
        if (bmuEl) bmuEl.value = maxUses;

+        const qosDown  = opt.value ? (parseInt(opt.dataset.qosDown)  || 0) : 0;
+        const qosUp    = opt.value ? (parseInt(opt.dataset.qosUp)    || 0) : 0;
+        const qosQuota = opt.value ? (parseInt(opt.dataset.qosQuota) || 0) : 0;
+        document.querySelectorAll('.qos-down-field').forEach(el => el.value = qosDown);
+        document.querySelectorAll('.qos-up-field').forEach(el => el.value = qosUp);
+        document.querySelectorAll('.qos-quota-field').forEach(el => el.value = qosQuota);
+
        const descEl = document.getElementById('template_desc');
        if (descEl) descEl.textContent = opt.dataset.desc || '';
    }
--- a/lang/de.php
+++ b/lang/de.php
@ -7,7 +7,13 @@ return [
    'nav_vouchers'      => 'Live Vouchers',
    'nav_templates'     => 'Voucher-Profile',
    'nav_audit_log'     => 'Audit-Log',
+    'nav_reports'       => 'Reporting',
+    'nav_import'        => 'Voucher-Import',
    'nav_settings'      => 'Einstellungen',
+    'nav_api_keys'      => 'API-Schlüssel',
+    'nav_security'      => 'Sicherheit (2FA)',
+    'nav_integrations'  => 'Integration & Wartung',
+    'nav_backup'        => 'Backup & Restore',
    'nav_update'        => 'System-Update',
    'nav_back'          => 'Zurück zur Startseite',
    'nav_administration'=> 'Administration',
--- a/lang/en.php
+++ b/lang/en.php
@ -7,7 +7,13 @@ return [
    'nav_vouchers'      => 'Live Vouchers',
    'nav_templates'     => 'Voucher Profiles',
    'nav_audit_log'     => 'Audit Log',
+    'nav_reports'       => 'Reporting',
+    'nav_import'        => 'Voucher Import',
    'nav_settings'      => 'Settings',
+    'nav_api_keys'      => 'API Keys',
+    'nav_security'      => 'Security (2FA)',
+    'nav_integrations'  => 'Integration & Maintenance',
+    'nav_backup'        => 'Backup & Restore',
    'nav_update'        => 'System Update',
    'nav_back'          => 'Back to Home',
    'nav_administration'=> 'Administration',
--- a/login.php
+++ b/login.php
@ -19,8 +19,21 @@ I18n::init();

 $error   = '';
 $success = '';
+$show2fa = false;

-if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['totp_code'])) {
+    // Zweiter Login-Schritt: 2FA-Code
+    try {
+        if ($auth->verifyTotpLogin(trim($_POST['totp_code']))) {
+            header('Location: index.php');
+            exit;
+        }
+        $error   = 'Code ungültig oder abgelaufen. Bitte erneut versuchen.';
+        $show2fa = $auth->isTotpPending();
+    } catch (Exception $e) {
+        $error = 'Login-Fehler: ' . $e->getMessage();
+    }
+} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
    try {
        $email    = trim($_POST['email'] ?? '');
        $password = $_POST['password'] ?? '';
@ -32,6 +45,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            if ($result === true) {
                header('Location: index.php');
                exit;
+            } elseif ($result === 'totp_required') {
+                $show2fa = true;
            } elseif ($result === 'rate_limited') {
                $error = __('login_error_rate');
            } else {
@ -43,6 +58,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    }
 }

+// Direkter Aufruf mit ?2fa=1 (z.B. nach Redirect) und noch ausstehendem Login
+if (!$show2fa && isset($_GET['2fa']) && $auth->isTotpPending()) {
+    $show2fa = true;
+}
+
 try {
    $db       = Database::getInstance();
    $appTitle = $db->getSetting('app_title', 'UniFi Voucher System');
@ -74,6 +94,27 @@ try {
        $m365LoginUrl = "https://login.microsoftonline.com/$m365TenantId/oauth2/v2.0/authorize?" . http_build_query($params);
    }

+    // Generisches OIDC (optional)
+    $oidcEnabled  = $db->getSetting('oidc_enabled', '0') === '1'
+        && $db->getSetting('oidc_client_id', '') !== ''
+        && $db->getSetting('oidc_auth_url', '') !== '';
+    $oidcName     = $db->getSetting('oidc_name', 'SSO');
+    $oidcLoginUrl = '';
+    if ($oidcEnabled) {
+        $protocol   = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http';
+        $scriptPath = dirname($_SERVER['SCRIPT_NAME']);
+        $scriptPath = $scriptPath === '/' ? '' : $scriptPath;
+        $oidcState  = bin2hex(random_bytes(16));
+        $_SESSION['oidc_state'] = $oidcState;
+        $oidcLoginUrl = rtrim($db->getSetting('oidc_auth_url', ''), '?') . '?' . http_build_query([
+            'client_id'     => $db->getSetting('oidc_client_id', ''),
+            'response_type' => 'code',
+            'redirect_uri'  => $protocol . '://' . $_SERVER['HTTP_HOST'] . $scriptPath . '/oidc_callback.php',
+            'scope'         => $db->getSetting('oidc_scopes', 'openid profile email'),
+            'state'         => $oidcState,
+        ]);
+    }
+
    $showLocalLogin = isset($_GET['local']) && $_GET['local'] === '1';

 } catch (Exception $e) {
@ -146,7 +187,23 @@ try {
        <div class="alert alert-success"><?= htmlspecialchars($success) ?></div>
    <?php endif; ?>

-    <?php if ($m365Enabled && !$showLocalLogin): ?>
+    <?php if ($show2fa): ?>
+        <form method="post">
+            <p style="color:var(--text-secondary,#666);font-size:14px;margin-bottom:18px;">
+                Bitte geben Sie den 6-stelligen Code aus Ihrer Authenticator-App ein
+                – oder einen Ihrer Recovery-Codes.
+            </p>
+            <div class="form-group">
+                <label for="totp_code">Code</label>
+                <input type="text" id="totp_code" name="totp_code" maxlength="9"
+                       autocomplete="one-time-code" required autofocus
+                       placeholder="123456 oder XXXX-XXXX"
+                       style="letter-spacing:3px;text-align:center;font-size:18px;">
+            </div>
+            <button type="submit" class="btn">Bestätigen</button>
+        </form>
+        <a href="login.php" class="local-login-link">Abbrechen</a>
+    <?php elseif ($m365Enabled && !$showLocalLogin): ?>
        <a href="<?= htmlspecialchars($m365LoginUrl) ?>" class="btn-microsoft">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 23 23">
                <path fill="#f35325" d="M1 1h10v10H1z"/>
@ -187,6 +244,13 @@ try {
        <?php endif; ?>
    <?php endif; ?>

+    <?php if (!$show2fa && $oidcEnabled): ?>
+        <div class="divider"><span><?= __('or') ?></span></div>
+        <a href="<?= htmlspecialchars($oidcLoginUrl) ?>" class="btn" style="display:block;text-align:center;text-decoration:none;background:#444;">
+            🔑 <?= htmlspecialchars($oidcName) ?>
+        </a>
+    <?php endif; ?>
+
    <?php if ($publicAccess): ?>
        <a href="index.php" class="back-link"><?= __('login_back') ?></a>
    <?php endif; ?>
--- a/oidc_callback.php
+++ b/oidc_callback.php
@ -0,0 +1,101 @@
+<?php
+/**
+ * Generischer OpenID-Connect-Callback (Authorization-Code-Flow).
+ * Konfiguration unter Administration → Integration & Wartung.
+ * Nutzt denselben Account-Verknüpfungs-Mechanismus wie M365 (externe SSO-ID).
+ */
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+
+require_once __DIR__ . '/config.php';
+require_once __DIR__ . '/includes/Database.php';
+require_once __DIR__ . '/includes/Auth.php';
+
+$db   = Database::getInstance();
+$auth = new Auth();
+
+$clientId     = $db->getSetting('oidc_client_id', '');
+$clientSecret = $db->getSetting('oidc_client_secret', '');
+$tokenUrl     = $db->getSetting('oidc_token_url', '');
+$userinfoUrl  = $db->getSetting('oidc_userinfo_url', '');
+
+if ($db->getSetting('oidc_enabled', '0') !== '1' || $clientId === '' || $tokenUrl === '' || $userinfoUrl === '') {
+    die('OIDC ist nicht konfiguriert. <a href="login.php">Zurück zum Login</a>');
+}
+
+if (isset($_GET['error'])) {
+    die('OIDC-Fehler: ' . htmlspecialchars($_GET['error']) . '<br><a href="login.php">Zurück zum Login</a>');
+}
+if (!isset($_GET['code'])) {
+    die('Kein Authorization Code erhalten.<br><a href="login.php">Zurück zum Login</a>');
+}
+
+// State validieren (CSRF)
+$sessionState = $_SESSION['oidc_state'] ?? '';
+$returnedState = $_GET['state'] ?? '';
+unset($_SESSION['oidc_state']);
+if ($sessionState === '' || !hash_equals($sessionState, $returnedState)) {
+    die('Ungültiger Sicherheits-Token (state).<br><a href="login.php">Zurück zum Login</a>');
+}
+
+$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
+$scriptPath = dirname($_SERVER['SCRIPT_NAME']);
+$scriptPath = $scriptPath === '/' ? '' : $scriptPath;
+$redirectUri = $protocol . '://' . $_SERVER['HTTP_HOST'] . $scriptPath . '/oidc_callback.php';
+
+// Code -> Token
+$ch = curl_init($tokenUrl);
+curl_setopt_array($ch, [
+    CURLOPT_POST => true,
+    CURLOPT_POSTFIELDS => http_build_query([
+        'grant_type'    => 'authorization_code',
+        'code'          => $_GET['code'],
+        'redirect_uri'  => $redirectUri,
+        'client_id'     => $clientId,
+        'client_secret' => $clientSecret,
+    ]),
+    CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded', 'Accept: application/json'],
+    CURLOPT_RETURNTRANSFER => true,
+    CURLOPT_TIMEOUT => 15,
+]);
+$resp = curl_exec($ch);
+$httpCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+curl_close($ch);
+$token = json_decode((string)$resp, true);
+
+if ($httpCode !== 200 || empty($token['access_token'])) {
+    die('Token-Abruf fehlgeschlagen (HTTP ' . $httpCode . ').<br><a href="login.php">Zurück zum Login</a>');
+}
+
+// Userinfo abrufen
+$ch = curl_init($userinfoUrl);
+curl_setopt_array($ch, [
+    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $token['access_token'], 'Accept: application/json'],
+    CURLOPT_RETURNTRANSFER => true,
+    CURLOPT_TIMEOUT => 15,
+]);
+$uResp = curl_exec($ch);
+$uCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+curl_close($ch);
+$info = json_decode((string)$uResp, true);
+
+if ($uCode !== 200 || !is_array($info)) {
+    die('Benutzerinfo-Abruf fehlgeschlagen (HTTP ' . $uCode . ').<br><a href="login.php">Zurück zum Login</a>');
+}
+
+$sub   = $info['sub'] ?? ($info['id'] ?? '');
+$email = $info['email'] ?? ($info['preferred_username'] ?? '');
+$name  = $info['name'] ?? trim(($info['given_name'] ?? '') . ' ' . ($info['family_name'] ?? ''));
+if ($sub === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+    die('OIDC lieferte keine gültige Identität (sub/email).<br><a href="login.php">Zurück zum Login</a>');
+}
+
+try {
+    // Wiederverwendung der externen-SSO-Verknüpfung (microsoft_id = externe ID)
+    $auth->loginWithMicrosoft(['id' => 'oidc:' . $sub, 'email' => $email, 'name' => $name ?: $email]);
+    header('Location: index.php');
+    exit;
+} catch (Exception $e) {
+    die('Login-Fehler: ' . htmlspecialchars($e->getMessage()) . '<br><a href="login.php">Zurück zum Login</a>');
+}
--- a/phpstan.neon
+++ b/phpstan.neon
@ -0,0 +1,6 @@
+parameters:
+    level: 5
+    paths:
+        - includes/Totp.php
+        - includes/Crypto.php
+        - includes/ApiKey.php
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         bootstrap="vendor/autoload.php"
+         colors="true"
+         failOnWarning="true">
+    <testsuites>
+        <testsuite name="unit">
+            <directory>tests</directory>
+        </testsuite>
+    </testsuites>
+</phpunit>
--- a/tests/ApiKeyTest.php
+++ b/tests/ApiKeyTest.php
@ -0,0 +1,35 @@
+<?php
+namespace Tests;
+
+use PHPUnit\Framework\TestCase;
+
+require_once __DIR__ . '/../includes/ApiKey.php';
+
+final class ApiKeyTest extends TestCase
+{
+    public function testGenerateFormat(): void
+    {
+        $k = \ApiKey::generate();
+        $this->assertStringStartsWith('uvt_', $k['plain']);
+        $this->assertSame(44, strlen($k['plain']));
+        $this->assertSame(hash('sha256', $k['plain']), $k['hash']);
+        $this->assertSame(substr($k['plain'], 4, 8), $k['prefix']);
+    }
+
+    public function testScopes(): void
+    {
+        $read  = ['scope' => 'read'];
+        $write = ['scope' => 'write'];
+        $this->assertTrue(\ApiKey::hasScope($read, 'read'));
+        $this->assertFalse(\ApiKey::hasScope($read, 'write'));
+        $this->assertTrue(\ApiKey::hasScope($write, 'read'));
+        $this->assertTrue(\ApiKey::hasScope($write, 'write'));
+    }
+
+    public function testFromRequestBearer(): void
+    {
+        $_SERVER['HTTP_AUTHORIZATION'] = 'Bearer uvt_testkey123';
+        $this->assertSame('uvt_testkey123', \ApiKey::fromRequest());
+        unset($_SERVER['HTTP_AUTHORIZATION']);
+    }
+}
--- a/tests/CryptoTest.php
+++ b/tests/CryptoTest.php
@ -0,0 +1,39 @@
+<?php
+namespace Tests;
+
+use PHPUnit\Framework\TestCase;
+
+if (!defined('APP_KEY')) {
+    define('APP_KEY', base64_encode(random_bytes(32)));
+}
+require_once __DIR__ . '/../includes/Crypto.php';
+
+final class CryptoTest extends TestCase
+{
+    public function testRoundtrip(): void
+    {
+        $plain = 'geheim;mit"sonder@zeichen';
+        $cipher = \Crypto::encrypt($plain);
+        $this->assertNotSame($plain, $cipher);
+        $this->assertTrue(\Crypto::isEncrypted($cipher));
+        $this->assertSame($plain, \Crypto::decrypt($cipher));
+    }
+
+    public function testPlaintextPassthrough(): void
+    {
+        // Legacy-/Klartextwerte werden unverändert zurückgegeben.
+        $this->assertSame('altesKlartextPW', \Crypto::decrypt('altesKlartextPW'));
+    }
+
+    public function testEmptyValues(): void
+    {
+        $this->assertSame('', \Crypto::encrypt(''));
+        $this->assertNull(\Crypto::decrypt(null));
+    }
+
+    public function testGenerateKeyLength(): void
+    {
+        $key = \Crypto::generateKey();
+        $this->assertSame(32, strlen(base64_decode($key)));
+    }
+}
--- a/tests/MigrationSplitterTest.php
+++ b/tests/MigrationSplitterTest.php
@ -0,0 +1,42 @@
+<?php
+namespace Tests;
+
+use PHPUnit\Framework\TestCase;
+
+require_once __DIR__ . '/../updater/MigrationRunner.php';
+
+final class MigrationSplitterTest extends TestCase
+{
+    private function split(string $sql): array
+    {
+        $rc = new \ReflectionClass(\Updater\MigrationRunner::class);
+        $inst = $rc->newInstanceWithoutConstructor();
+        $m = $rc->getMethod('splitStatements');
+        $m->setAccessible(true);
+        $parts = $m->invoke($inst, $sql);
+        return array_values(array_filter(array_map('trim', $parts), fn($s) => $s !== ''));
+    }
+
+    public function testIgnoresSemicolonsInStringsAndComments(): void
+    {
+        $sql = "INSERT INTO t (a) VALUES (\";semi;colon\"); -- comment; not split\n"
+             . "CREATE TABLE x (id INT); /* block ; comment */ INSERT INTO y VALUES (1);";
+        $parts = $this->split($sql);
+        $this->assertCount(3, $parts);
+    }
+
+    public function testSingleStatement(): void
+    {
+        $parts = $this->split("ALTER TABLE users ADD COLUMN foo INT");
+        $this->assertCount(1, $parts);
+    }
+
+    public function testIgnorableErrorDetection(): void
+    {
+        $rc = new \ReflectionClass(\Updater\MigrationRunner::class);
+        $inst = $rc->newInstanceWithoutConstructor();
+        $this->assertTrue($inst->isIgnorableSqlError('Duplicate column name "x"', 'mysql'));
+        $this->assertTrue($inst->isIgnorableSqlError('Table already exists', 'mysql'));
+        $this->assertFalse($inst->isIgnorableSqlError('Syntax error near FROM', 'mysql'));
+    }
+}
--- a/tests/TotpTest.php
+++ b/tests/TotpTest.php
@ -0,0 +1,46 @@
+<?php
+namespace Tests;
+
+use PHPUnit\Framework\TestCase;
+
+require_once __DIR__ . '/../includes/Totp.php';
+
+final class TotpTest extends TestCase
+{
+    /** RFC 6238 Testvektoren (SHA1, 6 Stellen, Seed "12345678901234567890"). */
+    public function testRfc6238Vectors(): void
+    {
+        $secret = 'GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ'; // Base32 des RFC-Seeds
+        $this->assertSame('287082', \Totp::code($secret, intdiv(59, 30)));
+        $this->assertSame('081804', \Totp::code($secret, intdiv(1111111109, 30)));
+        $this->assertSame('005924', \Totp::code($secret, intdiv(1234567890, 30)));
+    }
+
+    public function testVerifyAcceptsCurrentCode(): void
+    {
+        $secret = \Totp::generateSecret();
+        $code = \Totp::code($secret);
+        $this->assertTrue(\Totp::verify($secret, $code));
+    }
+
+    public function testVerifyRejectsWrongCode(): void
+    {
+        $secret = \Totp::generateSecret();
+        $wrong = \Totp::code($secret) === '000000' ? '111111' : '000000';
+        $this->assertFalse(\Totp::verify($secret, $wrong));
+    }
+
+    public function testVerifyRejectsMalformed(): void
+    {
+        $secret = \Totp::generateSecret();
+        $this->assertFalse(\Totp::verify($secret, 'abcdef'));
+        $this->assertFalse(\Totp::verify($secret, '12345'));
+    }
+
+    public function testProvisioningUri(): void
+    {
+        $uri = \Totp::provisioningUri('ABC', 'user@example.com', 'My App');
+        $this->assertStringStartsWith('otpauth://totp/', $uri);
+        $this->assertStringContainsString('secret=ABC', $uri);
+    }
+}
--- a/updater/migrations/0002_extended_features.sql
+++ b/updater/migrations/0002_extended_features.sql
@ -0,0 +1,27 @@
+-- Updater-Migration: Schema fuer erweiterte Funktionen
+--   * 2FA (TOTP) fuer lokale Accounts
+--   * Bandbreiten-/Datenlimits in Voucher-Profilen
+--   * REST-API-Schluessel
+-- Idempotent gehalten; "duplicate column"/"already exists" werden vom
+-- MigrationRunner ignoriert.
+
+ALTER TABLE `users` ADD COLUMN `totp_secret` VARCHAR(64) NULL;
+ALTER TABLE `users` ADD COLUMN `totp_enabled` TINYINT(1) NOT NULL DEFAULT 0;
+
+ALTER TABLE `voucher_templates` ADD COLUMN `qos_rate_max_down` INT NULL;
+ALTER TABLE `voucher_templates` ADD COLUMN `qos_rate_max_up` INT NULL;
+ALTER TABLE `voucher_templates` ADD COLUMN `qos_usage_quota` INT NULL;
+
+CREATE TABLE IF NOT EXISTS `api_keys` (
+  `id` INT PRIMARY KEY AUTO_INCREMENT,
+  `name` VARCHAR(255) NOT NULL,
+  `key_prefix` VARCHAR(16) NOT NULL,
+  `key_hash` VARCHAR(255) NOT NULL,
+  `created_by` INT,
+  `last_used_at` TIMESTAMP NULL,
+  `is_active` TINYINT(1) NOT NULL DEFAULT 1,
+  `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+  FOREIGN KEY (`created_by`) REFERENCES `users`(`id`) ON DELETE SET NULL,
+  INDEX `idx_prefix` (`key_prefix`),
+  INDEX `idx_active` (`is_active`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
--- a/updater/migrations/0003_maturity_features.sql
+++ b/updater/migrations/0003_maturity_features.sql
@ -0,0 +1,16 @@
+-- Updater-Migration: Reife-Funktionen
+--   * 2FA Recovery-/Backup-Codes
+--   * API-Scopes & Rate-Limit pro Schlüssel
+-- Idempotent; "duplicate column"/"already exists" werden ignoriert.
+
+ALTER TABLE `users` ADD COLUMN `totp_backup_codes` TEXT NULL;
+
+ALTER TABLE `api_keys` ADD COLUMN `scope` VARCHAR(16) NOT NULL DEFAULT 'write';
+ALTER TABLE `api_keys` ADD COLUMN `rate_limit` INT NOT NULL DEFAULT 0;
+
+CREATE TABLE IF NOT EXISTS `api_key_hits` (
+  `id` BIGINT PRIMARY KEY AUTO_INCREMENT,
+  `api_key_id` INT NOT NULL,
+  `hit_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+  INDEX `idx_key_time` (`api_key_id`, `hit_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
--- a/updater/migrations/0004_db_sessions.sql
+++ b/updater/migrations/0004_db_sessions.sql
@ -0,0 +1,5 @@
+-- Updater-Migration: DB-gestützte Sessions zulassen.
+-- user_id muss NULL erlauben (anonyme Sessions vor dem Login).
+-- Idempotent genug: bei bereits NULL-barer Spalte ist das ein No-Op.
+
+ALTER TABLE `sessions` MODIFY `user_id` INT NULL;