Major refactor: auth, bug fixes, security hardening, modular routes

Bug fixes
- Sync database.js schema with actual production DB (tarifoptionen
  shape was wrong; new installs would have broken).
- Fix SQL syntax error `SELECT to.*` (reserved keyword) in single-
  schaltung provision endpoint, plus the dead fallback hierarchy
  that selected columns that were never in the query.
- Fix PUT /api/tarifoptionen/:id writing to non-existent column
  provision_betrag (should be provision_euro).
- Fix race condition in PUT /api/schaltungen/:id where forEach with
  async db.run inside a transaction could send duplicate responses.
- Delete dokumente rows explicitly before deleting schaltung
  (existing DBs lack ON DELETE CASCADE on dokumente FK).
- Replace hardcoded basisBetrag=100 for percent rules; basis is now
  configurable per rule via the new basis_euro column.

Security
- Multi-user authentication: users table, bcryptjs, express-session
  with SQLite store, login/logout/me/setup/change-password endpoints.
- Auth gate on all /api/* except /api/auth/*.
- CLI to create users: npm run create-user -- <user> <pass> [--admin].
- helmet for security headers.
- CORS restricted to ALLOWED_ORIGINS env (default same-origin).
- Rate limits: 300/min global, 20/15min on login.
- Path-traversal validation on document download/delete.
- XSS hardening in frontend: escapeHtml helper applied to all
  DB-derived innerHTML interpolations; inline onclick handlers that
  embedded user-controlled strings replaced with data-* attrs +
  addEventListener.

Architecture
- Provision calculation centralised in provisionService.js as the
  single source of truth (was duplicated and inconsistent).
- server.js cut from 2138 to ~140 lines; routes split into per-
  resource modules under routes/.
- Promise wrapper db.js for sqlite3 callbacks; async/await in routes.
- middleware/ for auth and async error handling.

Tests
- 14 unit tests for provisionService covering fallback hierarchy,
  percent calculation, tarifoptionen, hardware logic, employee
  commission. All green.

Config
- dotenv loads .env.local at startup (gitignored).
- .gitignore extended for sessions.db and .env*.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routes/auth.js

@@ -0,0 +1,120 @@
+const express = require('express');
+const bcrypt = require('bcryptjs');
+const rateLimit = require('express-rate-limit');
+const db = require('../db');
+const asyncHandler = require('../middleware/asyncHandler');
+const { requireLogin } = require('../middleware/auth');
+
+const router = express.Router();
+
+const loginLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: 20,
+    message: { error: 'Zu viele Anmeldeversuche, bitte später erneut versuchen.' },
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+
+// Whether the system needs initial setup (no users yet).
+router.get('/setup-required', asyncHandler(async (req, res) => {
+    const row = await db.get('SELECT COUNT(*) AS n FROM users');
+    res.json({ setupRequired: row.n === 0 });
+}));
+
+// One-shot setup: create the first admin user. Only works when users table is empty.
+router.post('/setup', asyncHandler(async (req, res) => {
+    const existing = await db.get('SELECT COUNT(*) AS n FROM users');
+    if (existing.n > 0) {
+        return res.status(403).json({ error: 'Setup bereits abgeschlossen' });
+    }
+    const { username, password, displayName } = req.body || {};
+    if (!username || !password) {
+        return res.status(400).json({ error: 'Username und Passwort erforderlich' });
+    }
+    if (password.length < 8) {
+        return res.status(400).json({ error: 'Passwort muss mindestens 8 Zeichen lang sein' });
+    }
+    const hash = await bcrypt.hash(password, 10);
+    const result = await db.run(
+        'INSERT INTO users (username, password_hash, display_name, is_admin) VALUES (?, ?, ?, 1)',
+        [username, hash, displayName || username]
+    );
+    req.session.userId = result.lastID;
+    req.session.username = username;
+    req.session.isAdmin = true;
+    res.json({ id: result.lastID, username, isAdmin: true });
+}));
+
+router.post('/login', loginLimiter, asyncHandler(async (req, res) => {
+    const { username, password } = req.body || {};
+    if (!username || !password) {
+        return res.status(400).json({ error: 'Username und Passwort erforderlich' });
+    }
+    const user = await db.get(
+        'SELECT id, username, password_hash, display_name, is_admin FROM users WHERE username = ?',
+        [username]
+    );
+    if (!user) {
+        return res.status(401).json({ error: 'Ungültige Anmeldedaten' });
+    }
+    const ok = await bcrypt.compare(password, user.password_hash);
+    if (!ok) {
+        return res.status(401).json({ error: 'Ungültige Anmeldedaten' });
+    }
+    req.session.regenerate((err) => {
+        if (err) return res.status(500).json({ error: 'Session-Fehler' });
+        req.session.userId = user.id;
+        req.session.username = user.username;
+        req.session.isAdmin = !!user.is_admin;
+        res.json({
+            id: user.id,
+            username: user.username,
+            displayName: user.display_name,
+            isAdmin: !!user.is_admin,
+        });
+    });
+}));
+
+router.post('/logout', (req, res) => {
+    if (!req.session) return res.json({ ok: true });
+    req.session.destroy(() => {
+        res.clearCookie('connect.sid');
+        res.json({ ok: true });
+    });
+});
+
+router.get('/me', requireLogin, asyncHandler(async (req, res) => {
+    const user = await db.get(
+        'SELECT id, username, display_name, is_admin FROM users WHERE id = ?',
+        [req.session.userId]
+    );
+    if (!user) {
+        req.session.destroy(() => {});
+        return res.status(401).json({ error: 'Benutzer nicht gefunden' });
+    }
+    res.json({
+        id: user.id,
+        username: user.username,
+        displayName: user.display_name,
+        isAdmin: !!user.is_admin,
+    });
+}));
+
+router.post('/change-password', requireLogin, asyncHandler(async (req, res) => {
+    const { oldPassword, newPassword } = req.body || {};
+    if (!oldPassword || !newPassword) {
+        return res.status(400).json({ error: 'Altes und neues Passwort erforderlich' });
+    }
+    if (newPassword.length < 8) {
+        return res.status(400).json({ error: 'Neues Passwort muss mindestens 8 Zeichen lang sein' });
+    }
+    const user = await db.get('SELECT password_hash FROM users WHERE id = ?', [req.session.userId]);
+    if (!user) return res.status(401).json({ error: 'Benutzer nicht gefunden' });
+    const ok = await bcrypt.compare(oldPassword, user.password_hash);
+    if (!ok) return res.status(401).json({ error: 'Altes Passwort falsch' });
+    const newHash = await bcrypt.hash(newPassword, 10);
+    await db.run('UPDATE users SET password_hash = ? WHERE id = ?', [newHash, req.session.userId]);
+    res.json({ ok: true });
+}));
+
+module.exports = router;