feat: Add password login system and upgrade agent models

- App-level password auth via Flask session (APP_PASSWORD in .env)
- login_required decorator on all routes
- Login page, logout button in navbar, 7-day session lifetime
- Upgrade musik_rechte_advisor and negotiator from Opus 4.0 to Opus 4.6
- Fix orchestrator session cookie overflow (kb/prompts no longer stored in session)
- Change app port from 5000 to 5050 (5000 occupied by Zou/Kitsu)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/base.html

@@ -70,6 +70,11 @@
               <span>⚙</span> Settings
             </a>
           </li>
+          <li class="nav-item">
+            <a class="nav-link" href="/logout">
+              <span>🚪</span> Logout
+            </a>
+          </li>
         </ul>
       </div>
     </div>