security/api/betrieb: Fortify-2FA-Nebenwege gesperrt, Policy nur für aktive Super-Admins, Nachprüfungen aus dem Umsetzungsaudit (Block 7, U08–U10, U13, 7.1, 7.2, 7.5)

- Fortifys sieben 2FA-Verwaltungsrouten antworten mit 404 (Middleware über
  fortify.middleware); die Sicherheitsseite verlangt weiter den zweiten Faktor (U09)
- PressReleasePolicy/CompanyPolicy::before() bejahen nur aktive Super-Admins (7.2)
- API-Update prüft bei Portalwechsel die bestehende Kategorie gegen das neue Portal (U10)
- Aggregation: Zeitbudget 480 s unter dem Lock von 600 s, Marke nur unter
  Zeilensperre vom erwarteten Stand aus, sonst Fehler-Exit (U13)
- Newsletter-Bereinigungsmigration behält je Paar die sent-Zeile (U08)
- E-Mail-Wechsel stößt den Rechte-Sync sofort an; company-memberships:audit
  --classify zeigt vorher die Kandidaten und begrenzt mit --before (7.1)
- Detailseite wählt bei Slug-Kollision wie der Melde-Resolver (7.5)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/Feature/Web/PressReleaseTrackingTest.php

@@ -13,6 +13,7 @@ use App\Models\PressReleaseEvent;
 use App\Models\User;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
 use Livewire\Volt\Volt as LivewireVolt;
 use Tests\TestCase;
 
@@ -265,3 +266,46 @@ test('a second aggregation run is refused while another one holds the lock (Audi
     $this->artisan('press-releases:aggregate-views')->assertSuccessful();
     expect(PressRelease::withoutGlobalScopes()->find($release->id)->hits)->toBe(1);
 });
+
+test('the aggregation stops at its time budget and continues on the next run (Audit U13)', function () {
+    /** @var TestCase $this */
+    $release = trackingRelease(['hits' => 0]);
+    $url = 'https://businessportal24.test/de/press-release/'.$release->slug;
+    $this->get($url)->assertSuccessful();
+    $this->get($url)->assertSuccessful();
+    $this->get($url)->assertSuccessful();
+
+    // Budget 0: der erste Durchgang läuft gar nicht erst an.
+    $this->artisan('press-releases:aggregate-views', ['--budget' => 0])
+        ->expectsOutputToContain('Zeitbudget')
+        ->assertSuccessful();
+    expect(PressRelease::withoutGlobalScopes()->find($release->id)->hits)->toBe(0);
+
+    $this->artisan('press-releases:aggregate-views')->assertSuccessful();
+    expect(PressRelease::withoutGlobalScopes()->find($release->id)->hits)->toBe(3);
+});
+
+test('a run whose watermark was moved by another run books nothing twice (Audit U13)', function () {
+    /** @var TestCase $this */
+    $release = trackingRelease(['hits' => 0]);
+    $url = 'https://businessportal24.test/de/press-release/'.$release->slug;
+    $this->get($url)->assertSuccessful();
+
+    $latest = (int) PressReleaseEvent::query()->max('id');
+    $moved = false;
+
+    // Nachdem der Lauf seinen Durchgang gezählt hat, aber bevor er verbucht,
+    // schiebt ein „anderer Lauf“ die Marke bereits über dieses Ereignis.
+    DB::listen(function ($query) use (&$moved, $latest): void {
+        if (! $moved && str_contains($query->sql, 'count(*) as views')) {
+            $moved = true;
+            DB::table('app_settings')->where('key', AggregatePressReleaseViews::WatermarkKey)->update(['value' => json_encode($latest)]);
+        }
+    });
+
+    $this->artisan('press-releases:aggregate-views')->assertFailed();
+
+    expect($moved)->toBeTrue()
+        ->and(PressRelease::withoutGlobalScopes()->find($release->id)->hits)->toBe(0)
+        ->and((int) DB::table('app_settings')->where('key', AggregatePressReleaseViews::WatermarkKey)->value('value'))->toBe($latest);
+});