WS-6: E-Mail-Verifizierung, Auth-Flow-Fixes & Legacy-Rollen-Sicherheitsfix

E-Mail-Verifizierung (Entscheidung 15.06.):
- User implementiert MustVerifyEmail; Registrierung legt inaktives, rollenloses
  Konto an und leitet auf die Danke-/Notice-Seite; Registered-Event versendet die
  Verifizierungsmail. Bestätigter Link aktiviert das Konto + vergibt customer-Rolle
  (ActivateUserAfterVerification). Backfill-Migration setzt email_verified_at für
  alle Bestands-User (sonst würde die verified-Middleware ~59k aktive Legacy-User
  aussperren). Seeder-User verifiziert.

Auth-Flow-Korrekturen:
- Magic-Link-Consume: rollensicherer Redirect ohne intended() (Customer landete
  sonst per stale intended=/dashboard im 403-Admin-Bereich).
- Guest-Redirect (bootstrap/app.php) rollen-/verifizierungsbewusst statt fix
  /dashboard – schließt die 403-Sackgasse auf /login und /register.
- Logout auf der Notice-Seite via echtes POST-Formular statt Livewire-Action
  (behebt 419 beim Session-Invalidate).
- Magic-Link-Anforderung über eigenes Modal mit separater E-Mail-Eingabe.
- Unverifizierte Login-Versuche landen auf der Notice-Seite.

Sicherheitsfix Legacy-Rollen:
- UserImporter mappte Alt-Gruppe 2 (Self-Publisher) auf editor (= Admin-Zugriff).
  Mapping auf customer korrigiert; Daten-Migration stuft die 65.950 fälschlichen
  Legacy-Editoren auf customer herab. Echte admin/api-only bleiben unberührt.

Tests: Registration, EmailVerification, Authentication (Guest-Redirect),
MagicLinkLogin (Modal/Redirect/Regression), Legacy-Import (Gruppen-Mapping).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Auth/AuthenticationTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
 use Livewire\Volt\Volt as LivewireVolt;
 use Tests\TestCase;
 
@@ -34,6 +35,20 @@ test('users can authenticate using the login screen', function () {
     expect($user->last_login_ip)->toBe('127.0.0.1');
 });
 
+test('unverified users are redirected to the verification notice on login', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->unverified()->create(['is_active' => false]);
+
+    LivewireVolt::test('auth.login')
+        ->set('email', $user->email)
+        ->set('password', 'password')
+        ->call('login')
+        ->assertHasNoErrors()
+        ->assertRedirect(route('verification.notice', absolute: false));
+
+    $this->assertAuthenticated();
+});
+
 test('users can not authenticate with invalid password', function () {
     /** @var TestCase $this */
     $user = User::factory()->create();
@@ -48,6 +63,30 @@ test('users can not authenticate with invalid password', function () {
     $this->assertGuest();
 });
 
+test('an authenticated customer visiting guest routes is not trapped on the admin dashboard', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    $customer = User::factory()->create(['is_active' => true]);
+    $customer->assignRole('customer');
+
+    $this->actingAs($customer)->get('/login')->assertRedirect(route('me.dashboard'));
+    $this->actingAs($customer)->get('/register')->assertRedirect(route('me.dashboard'));
+});
+
+test('an authenticated admin visiting guest routes lands on the admin dashboard', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->superAdmin()->create();
+
+    $this->actingAs($admin)->get('/login')->assertRedirect(route('dashboard'));
+});
+
+test('an unverified authenticated user visiting guest routes lands on the notice', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->unverified()->create(['is_active' => false]);
+
+    $this->actingAs($user)->get('/login')->assertRedirect(route('verification.notice'));
+});
+
 test('users can logout', function () {
     /** @var TestCase $this */
     $user = User::factory()->create();