Fix-Runde nach Review: alle Befunde behoben + echte Tests

- Metadaten-Preview WIEDERHERGESTELLT (Stub ueberschattete echte
  prescan-Implementierung), tote Altmodule geloescht
- Celery update_state statt Phantom-Task/erfundener API
- abcde-Kommando korrigiert (CD-Ripping war nie funktionsfaehig)
- JWT: fester Schluessel Pflicht, echtes Logout, Cleanup nur Abgelaufene
- main.py: crashende Endpoints (Path/secrets/api_keys), year-Bug,
  Admin-Login aus .env
- Ruff gruen (29 Funde), Tests: auth/cache_keys/ripping_helpers,
  Placebo-test_health raus
- SAVEPOINT: offene MakeMKV-Entscheidung SICHTBAR gemacht (Regel B)

docker/api/test_auth.py

@@ -0,0 +1,69 @@
+"""Tests für auth.py: Hashing, Token-Lebenszyklus, Blacklist."""
+
+import time
+
+from auth import (
+    add_to_blacklist,
+    cleanup_blacklist,
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    get_password_hash,
+    is_access_token,
+    is_blacklisted,
+    is_refresh_token,
+    token_blacklist,
+    verify_password,
+)
+
+
+def test_passwort_hash_roundtrip():
+    hashed = get_password_hash("geheim123")
+    assert hashed != "geheim123"
+    assert verify_password("geheim123", hashed) is True
+    assert verify_password("falsch", hashed) is False
+
+
+def test_access_token_roundtrip():
+    token = create_access_token({"sub": "commander"})
+    payload = decode_token(token)
+    assert payload is not None
+    assert payload["sub"] == "commander"
+    assert payload["type"] == "access"
+    assert is_access_token(token) is True
+    assert is_refresh_token(token) is False
+
+
+def test_refresh_token_roundtrip():
+    token = create_refresh_token({"sub": "commander"})
+    payload = decode_token(token)
+    assert payload is not None
+    assert payload["type"] == "refresh"
+    assert is_refresh_token(token) is True
+    assert is_access_token(token) is False
+
+
+def test_muell_token_gibt_none_und_false():
+    assert decode_token("kein.echter.token") is None
+    # Rückgabetyp muss bool sein, nicht None (Review-Fund 22.07.)
+    assert is_access_token("kein.echter.token") is False
+    assert is_refresh_token("kein.echter.token") is False
+
+
+def test_blacklist_logout_wirkt():
+    token = create_access_token({"sub": "commander"})
+    assert is_blacklisted(token) is False
+    add_to_blacklist(token)
+    assert is_blacklisted(token) is True
+
+
+def test_cleanup_entfernt_nur_abgelaufene():
+    """Review-Fund 22.07.: das alte cleanup löschte ALLES — Logout war Placebo."""
+    frisch = create_access_token({"sub": "commander"})
+    add_to_blacklist(frisch)
+    token_blacklist["laengst-abgelaufener-token"] = time.time() - 3600
+
+    cleanup_blacklist()
+
+    assert "laengst-abgelaufener-token" not in token_blacklist
+    assert is_blacklisted(frisch) is True