fix(security): demo sends nothing, hidden SMTP password, body limits (FLAW-33..38)

- Demo: senders for mail, Discord and webhooks refuse, no alarm ticker;
  test alarm, SMTP test, server settings, backups, account and session
  changes of the shared demo accounts answer 403; the session list only
  shows the own device. The UI shows the notices and disables the controls.
- SMTP password is never sent back (smtpPassSet), empty keeps it.
- ?token= on webhook ingest accepts only API keys.
- Request bodies capped at 2 MB (sync 8 MB, imports 101 MB).
- Deleting an account removes its server backups.
- Backup downloads, exports and import uploads get 30 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_integrations.go

@@ -54,7 +54,13 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 
 // handleWebhookIngest accepts Smarthome / External automation webhooks via ?token=... or X-API-Key or Bearer token
 func (s *Server) handleWebhookIngest(w http.ResponseWriter, r *http.Request) {
+	// In the URL only API keys are taken (devices that cannot set headers); a session token there would
+	// end up in proxy logs as a full login (FLAW-35)
 	token := r.URL.Query().Get("token")
+	if token != "" && !strings.HasPrefix(token, "mindsift_sec_") {
+		writeError(w, http.StatusUnauthorized, "In der URL sind nur API-Keys erlaubt; Sitzungs-Tokens gehören in den Authorization-Header")
+		return
+	}
 	if token == "" {
 		token = r.Header.Get("X-API-Key")
 	}