feat: Web-UI als zweiter Ausgabeweg neben Avalonia-Shell (#490)

- Einheitlicher WebserverWorker in IBKRTrader.Hosting auf Kestrel-Basis
- Token-Authentifizierung (AuthService) mit zeitkonstantem Vergleich und HMAC-Session-Tokens
- OrderManager im Core fuer Bestands- und Reservierungsabgleich offener Broker-Orders
- SettingsSchema fuer reflexionsbasiertes Auslesen und sichere Aktualisierung ohne Klartext-Passwoerter
- SSE-Streaming (LogStreamService) fuer Echtzeit-Logs ueber isolierte Channels
- Statische Single-Page-Application in wwwroot (Avalonia Fluent / Polytrader Theme) fuer alle 9 Ansichten
- Unit-Tests fuer OrderManager, AuthService, SettingsSchema, LogStreamService und WebserverWorker (498 Tests gruen)

tests/IBKRTrader.Tests/Web/AuthServiceTests.cs

@@ -0,0 +1,111 @@
+using FluentAssertions;
+using IBKRTrader.Core.Settings;
+using IBKRTrader.Hosting.Web;
+
+namespace IBKRTrader.Tests.Web;
+
+[Trait("cat", "unit")]
+public class AuthServiceTests
+{
+    [Fact]
+    public void ValidateToken_ReturnsTrueForCorrectToken()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "secret-token-123";
+        var sut = new AuthService(settings);
+
+        sut.IsConfigured.Should().BeTrue();
+        sut.ValidateToken("secret-token-123").Should().BeTrue();
+        sut.ValidateToken("wrong-token").Should().BeFalse();
+        sut.ValidateToken("").Should().BeFalse();
+    }
+
+    [Fact]
+    public void ValidateToken_ReturnsFalseWhenNotConfigured()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "";
+        var sut = new AuthService(settings);
+
+        sut.IsConfigured.Should().BeFalse();
+        sut.ValidateToken("any-token").Should().BeFalse();
+    }
+
+    [Fact]
+    public void SessionToken_RoundTrip_ValidatesSuccessfully()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "my-secret-key";
+        var sut = new AuthService(settings);
+
+        var sessionToken = sut.CreateSessionToken(TimeSpan.FromHours(1));
+
+        sessionToken.Should().NotBeNullOrWhiteSpace();
+        sut.ValidateSessionToken(sessionToken).Should().BeTrue();
+    }
+
+    [Fact]
+    public void SessionToken_TamperedToken_FailsValidation()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "my-secret-key";
+        var sut = new AuthService(settings);
+
+        var sessionToken = sut.CreateSessionToken(TimeSpan.FromHours(1));
+        var tampered = sessionToken + "tamper";
+
+        sut.ValidateSessionToken(tampered).Should().BeFalse();
+    }
+
+    [Fact]
+    public void SessionToken_ExpiredToken_FailsValidation()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "my-secret-key";
+        var sut = new AuthService(settings);
+
+        // Abgelaufenes Token (minus 1 Sekunde)
+        var sessionToken = sut.CreateSessionToken(TimeSpan.FromSeconds(-10));
+
+        sut.ValidateSessionToken(sessionToken).Should().BeFalse();
+    }
+
+    [Fact]
+    public void IsAuthenticated_RecognizesBearerHeader()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "my-secret-key";
+        var sut = new AuthService(settings);
+
+        var ctx = new Microsoft.AspNetCore.Http.DefaultHttpContext();
+        ctx.Request.Headers.Authorization = "Bearer my-secret-key";
+
+        sut.IsAuthenticated(ctx).Should().BeTrue();
+    }
+
+    [Fact]
+    public void IsAuthenticated_RecognizesQueryToken()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "my-secret-key";
+        var sut = new AuthService(settings);
+
+        var ctx = new Microsoft.AspNetCore.Http.DefaultHttpContext();
+        ctx.Request.QueryString = new Microsoft.AspNetCore.Http.QueryString("?token=my-secret-key");
+
+        sut.IsAuthenticated(ctx).Should().BeTrue();
+    }
+
+    [Fact]
+    public void IsAuthenticated_RejectsUnauthenticatedRequest()
+    {
+        var settings = new SettingsService();
+        settings.Settings.Webserver.AuthToken = "my-secret-key";
+        var sut = new AuthService(settings);
+
+        var ctx = new Microsoft.AspNetCore.Http.DefaultHttpContext();
+
+        sut.IsAuthenticated(ctx).Should().BeFalse();
+    }
+}
+

tests/IBKRTrader.Tests/Web/LogStreamServiceTests.cs

@@ -0,0 +1,39 @@
+using FluentAssertions;
+using IBKRTrader.Core.Logging;
+using IBKRTrader.Hosting.Web;
+
+namespace IBKRTrader.Tests.Web;
+
+[Trait("cat", "unit")]
+public class LogStreamServiceTests
+{
+    [Fact]
+    public void GetRecent_CapturesLogEntries_AndCapsAtRingBufferSize()
+    {
+        var logger = new LoggingService();
+        using var sut = new LogStreamService(logger);
+
+        for (int i = 0; i < 150; i++)
+        {
+            logger.Info("TestModule", $"Message {i}");
+        }
+
+        var recent = sut.GetRecent();
+        recent.Count.Should().Be(100);
+    }
+
+    [Fact]
+    public void Dispose_UnsubscribesFromLogger()
+    {
+        var logger = new LoggingService();
+        var sut = new LogStreamService(logger);
+
+        logger.Info("TestModule", "Before dispose");
+        sut.GetRecent().Count.Should().Be(1);
+
+        sut.Dispose();
+
+        logger.Info("TestModule", "After dispose");
+        sut.GetRecent().Count.Should().Be(1);
+    }
+}

tests/IBKRTrader.Tests/Web/WebserverWorkerTests.cs

@@ -0,0 +1,60 @@
+using FluentAssertions;
+using IBKRTrader.Core.Logging;
+using IBKRTrader.Core.Persistence.Ef;
+using IBKRTrader.Core.Settings;
+using IBKRTrader.Core.Workers;
+using IBKRTrader.Hosting.Web;
+using Microsoft.EntityFrameworkCore;
+using NSubstitute;
+
+namespace IBKRTrader.Tests.Web;
+
+[Trait("cat", "unit")]
+public class WebserverWorkerTests
+{
+    private sealed class InMemoryFactory : IDbContextFactory<CoreDbContext>
+    {
+        private readonly DbContextOptions<CoreDbContext> _options;
+        public InMemoryFactory(DbContextOptions<CoreDbContext> options) => _options = options;
+        public CoreDbContext CreateDbContext() => new(_options);
+    }
+
+    private static (WebserverWorker Sut, SettingsService Settings) CreateSut(bool enabled = true, int port = 5001)
+    {
+        var options = new DbContextOptionsBuilder<CoreDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString())
+            .Options;
+        var dbf = new InMemoryFactory(options);
+        var settings = new SettingsService();
+        settings.Settings.Webserver.Enabled = enabled;
+        settings.Settings.Webserver.Port = port;
+
+        var logger = new LoggingService();
+        var sp = Substitute.For<IServiceProvider>();
+
+        var sut = new WebserverWorker(logger, dbf, settings, sp);
+        return (sut, settings);
+    }
+
+    [Fact]
+    public void Worker_Properties_AreConfiguredCorrectly()
+    {
+        var (sut, _) = CreateSut(enabled: true, port: 5001);
+
+        sut.Name.Should().Be("WebserverService");
+        sut.Module.Should().Be("Core");
+        sut.Type.Should().Be(WorkerType.Service);
+        sut.Info.Active.Should().BeTrue();
+        sut.Info.RunEvery.Should().Be("Service");
+        sut.Info.Info.Should().Be("Port 5001");
+    }
+
+    [Fact]
+    public void Worker_WhenDisabled_ReportsInactive()
+    {
+        var (sut, _) = CreateSut(enabled: false, port: 8080);
+
+        sut.Info.Active.Should().BeFalse();
+        sut.Info.Info.Should().Be("Deaktiviert");
+    }
+}