v3 Phase C: Security-Härtung + UX-Feedback

Security:
- Passwort-Leak dicht: os-update/reboot fuettern das sudo-Passwort ueber stdin
  (jobengine: neues stdin_data + sanitisierte Log-Zeile log_cmd). Verifiziert:
  Secret taucht nicht mehr im Job-Log/ps auf.
- /api/status liefert "secured" -> Topbar-Security-Chip zeigt ehrlich, ob Token aktiv.
- WS-Token-Auth funktioniert (Query-Param, war bereits in auth.py).
- Bind bleibt 0.0.0.0 (kein Aussperren), kein Token erzwungen.

UX-Feedback:
- Schnellstart-Bug gefixt (Titel/Text brechen um, .qa-main column).
- Cookbook: Sortier-Dropdown (Downloads/Likes/Aktualisiert/Trend) wie HuggingFace.
- Server & Wartung: Buttons -> selbsterklaerende Aktionszeilen mit Beschreibung;
  Reboot nur mit rotem Icon (Vollrot-Bug behoben).
- Live-Konsole: neue Option "System (ganzer Server)" -> journalctl ueber alle Units.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routers/maintenance.py

@@ -31,8 +31,11 @@ def update():
 
 @router.post("/os-update")
 def os_update(req: PwdReq):
-    cmd = f"echo {shlex.quote(req.password)} | sudo -S bash -c 'apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y'"
-    job_id = start_job(["bash", "-c", cmd], "os update")
+    # Passwort ueber stdin an sudo -S — NICHT als Klartext-Arg (sonst im Job-Log/ps sichtbar).
+    args = ["sudo", "-S", "bash", "-c",
+            "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y"]
+    job_id = start_job(args, "OS-Update (apt)", stdin_data=req.password + "\n",
+                       log_cmd="$ sudo apt-get update && apt-get upgrade -y")
     return {"job_id": job_id}
 
 @router.post("/service/{name}/restart")
@@ -44,19 +47,28 @@ def service_restart(name: str):
 
 @router.post("/reboot")
 def reboot(req: PwdReq):
-    cmd = f"echo {shlex.quote(req.password)} | sudo -S reboot"
-    subprocess.Popen(["bash", "-c", cmd])
+    # Passwort ueber stdin (nicht in argv -> nicht in ps sichtbar).
+    proc = subprocess.Popen(["sudo", "-S", "reboot"], stdin=subprocess.PIPE, text=True)
+    try:
+        proc.stdin.write(req.password + "\n")
+        proc.stdin.flush()
+    except Exception:  # noqa: BLE001
+        pass
     return {"ok": True, "note": "Reboot getriggert."}
 
 @router.websocket("/logs/{service}")
 async def stream_logs(websocket: WebSocket, service: str):
     await websocket.accept()
-    if service not in ("llama-swap", "mission-control"):
+    if service not in ("llama-swap", "mission-control", "system"):
         await websocket.close(code=1008)
         return
-        
+
+    if service == "system":
+        cmd = ["sudo", "journalctl", "-n", "100", "-f"]          # ganzer Server (alle Units)
+    else:
+        cmd = ["sudo", "journalctl", "-u", service, "-n", "100", "-f"]
     process = await asyncio.create_subprocess_exec(
-        "sudo", "journalctl", "-u", service, "-n", "100", "-f",
+        *cmd,
         stdout=asyncio.subprocess.PIPE,
         stderr=asyncio.subprocess.PIPE
     )