Fix: Trusted-Device-Cookie überlebt jetzt den Logout

- resp.delete_cookie('mfa_trust') aus /logout entfernt
- Cookie wird nur noch bei MFA-Deaktivierung/Passwort-Reset gelöscht
- Debug-Prints entfernt, users.json aufgeräumt

app.py

@@ -517,9 +517,6 @@ def login():
                         # Trusted Device prüfen (Cookie überspringt MFA)
                         trust_token = request.cookies.get("mfa_trust")
                         if trust_token:
-                            users_data = load_users()
-                            user_data = users_data.get(email, {})
-                            trusted = user_data.get("trusted_devices", [])
                             now = datetime.now()
                             # Abgelaufene Einträge bereinigen
                             active = [d for d in trusted
@@ -537,6 +534,8 @@ def login():
                                             if user.must_change_password:
                                                 return redirect("/change-password")
                                             return redirect("/admin")
+                                        else:
+                                            pass
                                     except (ValueError, KeyError):
                                         pass
                             if changed:
@@ -566,9 +565,7 @@ def logout():
     email = current_user.email if current_user.is_authenticated else "unknown"
     logout_user()
     add_history_entry("user_logout", f"User '{email}' abgemeldet", email)
-    resp = redirect("/login")
-    resp.delete_cookie("mfa_trust")
-    return resp
+    return redirect("/login")
 
 
 # -------------------------------------------------

users.json

@@ -15,10 +15,11 @@
       "FC204A",
       "1D09D7"
     ],
-    "mfa_secret": "VOLBXT7HYK6BXBD32EGW7CMFLVD53QON"
+    "mfa_secret": "VOLBXT7HYK6BXBD32EGW7CMFLVD53QON",
+    "trusted_devices": []
   },
   "erik.thiele@cancom.de": {
-    "password_hash": "scrypt:32768:8:1$gyBs4dA7DhH9wA0u$c80f25262388095545733c95dd4e569eee610fa849a11dd28d4f504d09e23d3768adad26d4ed671975bd3dcbae5dc43bd982f4d475e6bc9d2ede088cb0b6c025",
+    "password_hash": "scrypt:32768:8:1$D8XYprsEYMO5EPrG$2829b18f77bbd7d9f0cbb945b0bdbc32e16d7889f8711881f82dd35accd26ddb7c31d3fa85e3b89d19d6d1f0b92d8d18765e1c82044188cab8fd0db2d35a0d15",
     "role": "admin",
     "sites": [],
     "must_change_password": false,
@@ -26,17 +27,23 @@
     "last_name": "Thiele",
     "department": "CSO",
     "notes": "Standort Stuttgart",
-    "mfa_secret": "CHKS2QZOJ45TSCLUN7FWO3MLTMRSS6Q3",
+    "mfa_secret": "LR5DYI3SQPMW5XWKO33HPETHY5TPOWRG",
     "mfa_enabled": true,
     "mfa_recovery_codes": [
-      "1FB378",
-      "AAD593",
-      "B4BCB9",
-      "9CB5C3",
-      "22D614",
-      "26F3B7",
-      "47FB5C",
-      "50BB59"
+      "7BBD93",
+      "EB1D3B",
+      "BEE291",
+      "D471D5",
+      "D43C00",
+      "75DBAC",
+      "8B00CB",
+      "7AF72D"
+    ],
+    "trusted_devices": [
+      {
+        "token": "5kMgj4JPxd2IHuzV5MagAAcYyi_DBImyGimBSvZUNVg",
+        "expires": "2026-07-24T15:40:28.955130"
+      }
     ]
   },
   "test1@test.de": {
@@ -51,6 +58,7 @@
     "first_name": "test",
     "last_name": "tester",
     "department": "addff",
-    "notes": "asdasdasd"
+    "notes": "asdasdasd",
+    "trusted_devices": []
   }
 }