Phase 2: Fix high-priority security and stability issues (H1-H7)

H1: Sanitize error endpoint context (strip tokens/passwords, limit depth/size)
H2: Rate limiter IP spoofing fix (trusted proxy CIDR check for X-Forwarded-For)
H3: CSRF middleware uses Redis singleton instead of per-request connection
H4: WebSocket origin verification added to both kommunikation and ai_ui_control
H5: Storage path traversal protection, get_url() returns relative URL not filesystem path
H6: Security headers middleware (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy)
H7: Forward-repair migration 0045 for databases that ran original 0021/0027

Also: add trusted_proxy_cidrs to config, add verify_ws_origin to auth

app/plugins/builtins/kommunikation/routes.py

@@ -471,11 +471,15 @@ async def websocket_endpoint(
 
     Authenticates via session cookie. On connect, subscribes user to all their conversations.
     """
-    # Authenticate via session cookie
+    # Verify Origin header against allowed CORS origins
     from app.config import get_settings
-    from app.core.auth import get_session_data, get_redis
+    from app.core.auth import get_session_data, get_redis, verify_ws_origin
 
     settings = get_settings()
+    if not verify_ws_origin(websocket):
+        await websocket.close(code=4003, reason="Origin not allowed")
+        return
+
     session_id = websocket.cookies.get(settings.session_cookie_name)
     if not session_id:
         await websocket.close(code=4001, reason="Not authenticated")