Major refactor: auth, bug fixes, security hardening, modular routes

Bug fixes
- Sync database.js schema with actual production DB (tarifoptionen
  shape was wrong; new installs would have broken).
- Fix SQL syntax error `SELECT to.*` (reserved keyword) in single-
  schaltung provision endpoint, plus the dead fallback hierarchy
  that selected columns that were never in the query.
- Fix PUT /api/tarifoptionen/:id writing to non-existent column
  provision_betrag (should be provision_euro).
- Fix race condition in PUT /api/schaltungen/:id where forEach with
  async db.run inside a transaction could send duplicate responses.
- Delete dokumente rows explicitly before deleting schaltung
  (existing DBs lack ON DELETE CASCADE on dokumente FK).
- Replace hardcoded basisBetrag=100 for percent rules; basis is now
  configurable per rule via the new basis_euro column.

Security
- Multi-user authentication: users table, bcryptjs, express-session
  with SQLite store, login/logout/me/setup/change-password endpoints.
- Auth gate on all /api/* except /api/auth/*.
- CLI to create users: npm run create-user -- <user> <pass> [--admin].
- helmet for security headers.
- CORS restricted to ALLOWED_ORIGINS env (default same-origin).
- Rate limits: 300/min global, 20/15min on login.
- Path-traversal validation on document download/delete.
- XSS hardening in frontend: escapeHtml helper applied to all
  DB-derived innerHTML interpolations; inline onclick handlers that
  embedded user-controlled strings replaced with data-* attrs +
  addEventListener.

Architecture
- Provision calculation centralised in provisionService.js as the
  single source of truth (was duplicated and inconsistent).
- server.js cut from 2138 to ~140 lines; routes split into per-
  resource modules under routes/.
- Promise wrapper db.js for sqlite3 callbacks; async/await in routes.
- middleware/ for auth and async error handling.

Tests
- 14 unit tests for provisionService covering fallback hierarchy,
  percent calculation, tarifoptionen, hardware logic, employee
  commission. All green.

Config
- dotenv loads .env.local at startup (gitignored).
- .gitignore extended for sessions.db and .env*.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routes/anbieter.js

@@ -0,0 +1,81 @@
+const express = require('express');
+const db = require('../db');
+const asyncHandler = require('../middleware/asyncHandler');
+
+const router = express.Router();
+
+router.get('/', asyncHandler(async (req, res) => {
+    const rows = await db.all('SELECT * FROM anbieter ORDER BY name');
+    res.json(rows);
+}));
+
+router.post('/', asyncHandler(async (req, res) => {
+    const { name } = req.body || {};
+    if (!name || !name.trim()) {
+        return res.status(400).json({ error: 'Name ist erforderlich' });
+    }
+    try {
+        const result = await db.run('INSERT INTO anbieter (name) VALUES (?)', [name.trim()]);
+        res.json({ id: result.lastID, name: name.trim() });
+    } catch (err) {
+        if (/UNIQUE/.test(err.message)) {
+            return res.status(400).json({ error: 'Anbieter mit diesem Namen existiert bereits' });
+        }
+        throw err;
+    }
+}));
+
+router.delete('/:id', asyncHandler(async (req, res) => {
+    const { id } = req.params;
+
+    const [tariffeRow, schaltungenRow] = await Promise.all([
+        db.get('SELECT COUNT(*) AS n FROM tarife WHERE anbieter_id = ?', [id]),
+        db.get('SELECT COUNT(*) AS n FROM schaltungen WHERE anbieter_id = ?', [id]),
+    ]);
+
+    if (tariffeRow.n + schaltungenRow.n > 0) {
+        const reasons = [];
+        if (tariffeRow.n > 0) reasons.push(`${tariffeRow.n} Tarif(e)`);
+        if (schaltungenRow.n > 0) reasons.push(`${schaltungenRow.n} Schaltung(en)`);
+        return res.status(400).json({
+            error: `Anbieter kann nicht gelöscht werden: ${reasons.join(', ')} verwenden diesen Anbieter`,
+        });
+    }
+
+    const deletedRules = await db.run('DELETE FROM anbieter_provisionsregeln WHERE anbieter_id = ?', [id]);
+    const result = await db.run('DELETE FROM anbieter WHERE id = ?', [id]);
+    if (result.changes === 0) {
+        return res.status(404).json({ error: 'Anbieter nicht gefunden' });
+    }
+    let message = 'Anbieter erfolgreich gelöscht';
+    if (deletedRules.changes > 0) {
+        message += ` (${deletedRules.changes} Provisionsregel(n) wurden mit gelöscht)`;
+    }
+    res.json({ message });
+}));
+
+// Global commission rules for this provider
+router.get('/:id/provisionsregeln', asyncHandler(async (req, res) => {
+    const { id } = req.params;
+    const rows = await db.all(
+        `SELECT apr.*, a.name AS anbieter_name
+         FROM anbieter_provisionsregeln apr
+         JOIN anbieter a ON apr.anbieter_id = a.id
+         WHERE apr.anbieter_id = ? AND apr.aktiv = 1
+         ORDER BY apr.gueltig_ab DESC`,
+        [id]
+    );
+    res.json(rows);
+}));
+
+// Mitarbeiter-Prozentsätze for this provider
+router.get('/:id/mitarbeiter-prozentsaetze', asyncHandler(async (req, res) => {
+    const { id } = req.params;
+    const rows = await db.all(
+        'SELECT * FROM mitarbeiter_prozentsaetze WHERE anbieter_id = ? ORDER BY gueltig_ab DESC',
+        [id]
+    );
+    res.json(rows);
+}));
+
+module.exports = router;