fix: konstante Zeit fuer API-Key-Vergleich, Auth-Tests erweitert

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/tests/test_auth.py

@@ -12,3 +12,19 @@ def test_login_flow(client):
                     follow_redirects=False)
     assert r.status_code == 303
     assert client.get("/api/accounts").status_code == 200  # Cookie reicht
+
+
+def test_logout_flow(client):
+    r = client.post("/login", data={"username": "admin", "password": "geheim"},
+                    follow_redirects=False)
+    assert r.status_code == 303
+    assert client.get("/api/accounts").status_code == 200
+
+    r = client.post("/logout", follow_redirects=False)
+    assert r.status_code == 303
+    assert client.get("/api/accounts").status_code == 401
+
+
+def test_tampered_session_cookie_rejected(client):
+    client.cookies.set("fb_session", "gui.invalid-signature")
+    assert client.get("/api/accounts").status_code == 401