Admin: Login-Link mit window.location.origin statt Server-Host

- Backend gibt nur Token zurück statt fertigen Link
- Frontend baut Link via window.location.origin zusammen
- Zeigt korrekte Domain/Port statt internes http://127.0.0.1

Backend:
- AdminEndpoint: POST /api/admin/users/{userId}/login-link gibt { token }
- AuthEndpoint: GET /api/auth/autologin?token=xxx setzt Cookie + redirect
- AuthMiddleware: autologin-Route von Auth ausgenommen

Frontend:
- api.js: apiAdminGetLoginLink() Funktion
- admin-page.js: Login-as-User Button → Login-Link Button mit Modal
- form.css: Styling für Login-Link Modal

Endpoints/AuthEndpoint.cs

@@ -13,6 +13,7 @@ public static class AuthEndpoint
         app.MapPost("/api/auth/login", HandleLogin);
         app.MapPost("/api/auth/logout", HandleLogout);
         app.MapGet("/api/auth/me", HandleMe);
+        app.MapGet("/api/auth/autologin", HandleAutologin);
     }
 
     private static async System.Threading.Tasks.Task HandleLogin(HttpContext ctx, DatabaseService db, AuthService auth)
@@ -97,4 +98,33 @@ public static class AuthEndpoint
             defaultPath = user.DefaultPath
         });
     }
+
+    private static System.Threading.Tasks.Task HandleAutologin(HttpContext ctx, AuthService auth)
+    {
+        var token = ctx.Request.Query["token"].ToString();
+
+        if (string.IsNullOrEmpty(token))
+        {
+            ctx.Response.StatusCode = 400;
+            return ctx.Response.WriteAsync("Token fehlt");
+        }
+
+        var userId = auth.ValidateToken(token);
+        if (userId == null)
+        {
+            ctx.Response.StatusCode = 401;
+            return ctx.Response.WriteAsync("Ungültiger Token");
+        }
+
+        ctx.Response.Cookies.Append("gott_token", token, new CookieOptions
+        {
+            HttpOnly = true,
+            SameSite = SameSiteMode.Strict,
+            Path = "/",
+            MaxAge = System.TimeSpan.FromDays(365)
+        });
+
+        ctx.Response.Redirect("/");
+        return System.Threading.Tasks.Task.CompletedTask;
+    }
 }