TASK-022: Hash session tokens in database for security

- Store session tokens as one-way SHA256 hashes instead of plaintext
- Hash tokens on write (create_session) and on read (get_session, delete_session)
- Add migration to drop plaintext sessions table and recreate with token_hash column
- Update Session model: token field still contains raw token for signing
- Add test to verify tokens are hashed in database, not plaintext
- Update Architekture.md to document session token hashing
- Update Backend-Development.md with implementation pattern and best practices

Prevents direct session token hijacking if database file is exposed to attacker.
If plaintext DB was readable, sessions are invalidated by the migration anyway.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Tasks.md

@@ -1,31 +1,3 @@
-## TASK-021 — `set_jail_config_enabled` and `write_jail_config_file` not atomic
-
-**Severity:** Medium
-
-### Where found
-`backend/app/services/raw_config_io_service.py` lines ~268 (`set_jail_config_enabled`) and ~344 (`write_jail_config_file`) — both use `path.write_text(updated)` directly.
-
-### Why this is needed
-Same root cause as TASK-018. A process kill mid-write leaves the jail config file corrupted, disabling that jail on next fail2ban reload.
-
-### Goal
-Atomic writes for `set_jail_config_enabled` and `write_jail_config_file`.
-
-### What to do
-Same as TASK-018: replace `path.write_text(content)` with the `NamedTemporaryFile` + `os.replace()` pattern in both functions. This is most efficiently done as part of TASK-018 by extracting a shared `atomic_write(path, content)` helper in `config_file_helpers.py`.
-
-### Possible traps and issues
-- Same as TASK-018.
-- Extracting the helper makes TASK-018 and TASK-021 a single coordinated change.
-
-### Docs changes needed
-- `Backend-Development.md` — atomic write helper documentation.
-
-### Doc references
-- [Backend-Development.md](Backend-Development.md) — file I/O conventions
-
----
-
 ## TASK-022 — Session tokens stored in plaintext in SQLite
 
 **Severity:** High