Major refactor: auth, bug fixes, security hardening, modular routes

Bug fixes
- Sync database.js schema with actual production DB (tarifoptionen
  shape was wrong; new installs would have broken).
- Fix SQL syntax error `SELECT to.*` (reserved keyword) in single-
  schaltung provision endpoint, plus the dead fallback hierarchy
  that selected columns that were never in the query.
- Fix PUT /api/tarifoptionen/:id writing to non-existent column
  provision_betrag (should be provision_euro).
- Fix race condition in PUT /api/schaltungen/:id where forEach with
  async db.run inside a transaction could send duplicate responses.
- Delete dokumente rows explicitly before deleting schaltung
  (existing DBs lack ON DELETE CASCADE on dokumente FK).
- Replace hardcoded basisBetrag=100 for percent rules; basis is now
  configurable per rule via the new basis_euro column.

Security
- Multi-user authentication: users table, bcryptjs, express-session
  with SQLite store, login/logout/me/setup/change-password endpoints.
- Auth gate on all /api/* except /api/auth/*.
- CLI to create users: npm run create-user -- <user> <pass> [--admin].
- helmet for security headers.
- CORS restricted to ALLOWED_ORIGINS env (default same-origin).
- Rate limits: 300/min global, 20/15min on login.
- Path-traversal validation on document download/delete.
- XSS hardening in frontend: escapeHtml helper applied to all
  DB-derived innerHTML interpolations; inline onclick handlers that
  embedded user-controlled strings replaced with data-* attrs +
  addEventListener.

Architecture
- Provision calculation centralised in provisionService.js as the
  single source of truth (was duplicated and inconsistent).
- server.js cut from 2138 to ~140 lines; routes split into per-
  resource modules under routes/.
- Promise wrapper db.js for sqlite3 callbacks; async/await in routes.
- middleware/ for auth and async error handling.

Tests
- 14 unit tests for provisionService covering fallback hierarchy,
  percent calculation, tarifoptionen, hardware logic, employee
  commission. All green.

Config
- dotenv loads .env.local at startup (gitignored).
- .gitignore extended for sessions.db and .env*.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/provisionService.test.js

@@ -0,0 +1,138 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { calculate } = require('../provisionService');
+
+function baseInput(overrides = {}) {
+    return Object.assign({
+        schaltung: { hardware: null, hardware_ek: null, kundenverkaufspreis_netto: null },
+        tarif: { id: 1, name: 'Tarif X', provision_euro: 100, mitarbeiter_provision: 0, beschreibung: null },
+        tarifRule: null,
+        anbieterRule: null,
+        tarifoptionen: [],
+        mitarbeiterProzentsatz: 10,
+    }, overrides);
+}
+
+test('falls back to direct tariff commission when no rules exist', () => {
+    const r = calculate(baseInput());
+    assert.strictEqual(r.shop.betrag, 100);
+    assert.strictEqual(r.shop.quelle, 'Direkte Tarif-Provision');
+});
+
+test('tariff-specific fix rule wins over global and direct', () => {
+    const r = calculate(baseInput({
+        tarifRule: { provision_typ: 'fix', betrag: 50, basis_euro: null },
+        anbieterRule: { provision_typ: 'fix', betrag: 30, basis_euro: null },
+    }));
+    assert.strictEqual(r.shop.betrag, 50);
+    assert.strictEqual(r.shop.quelle, 'Tarif-spezifische Regel');
+});
+
+test('global anbieter rule applied when no tariff-specific rule', () => {
+    const r = calculate(baseInput({
+        tarifRule: null,
+        anbieterRule: { provision_typ: 'fix', betrag: 25, basis_euro: null },
+    }));
+    assert.strictEqual(r.shop.betrag, 25);
+    assert.strictEqual(r.shop.quelle, 'Globale Anbieter-Regel');
+});
+
+test('percent rule uses basis_euro as the base', () => {
+    const r = calculate(baseInput({
+        anbieterRule: { provision_typ: 'prozent', betrag: 12, basis_euro: 200 },
+    }));
+    assert.strictEqual(r.shop.betrag, 24);
+});
+
+test('percent rule with missing basis_euro yields 0', () => {
+    const r = calculate(baseInput({
+        anbieterRule: { provision_typ: 'prozent', betrag: 12, basis_euro: null },
+    }));
+    assert.strictEqual(r.shop.betrag, 0);
+});
+
+test('tarifoptionen are added (positive)', () => {
+    const r = calculate(baseInput({
+        tarifoptionen: [{ name: 'Bonus', provision_euro: 25 }],
+    }));
+    assert.strictEqual(r.shop.betrag, 125);
+    assert.strictEqual(r.tarifoptionen.betrag, 25);
+});
+
+test('tarifoptionen rebates (negative) reduce commission', () => {
+    const r = calculate(baseInput({
+        tarifoptionen: [{ name: 'Rabatt', provision_euro: -30 }],
+    }));
+    assert.strictEqual(r.shop.betrag, 70);
+});
+
+test('hardware adds (KVP - EK) to commission', () => {
+    const r = calculate(baseInput({
+        schaltung: { hardware: '123456789012345', hardware_ek: 40, kundenverkaufspreis_netto: 100 },
+    }));
+    assert.strictEqual(r.shop.betrag, 160); // 100 + (100 - 40)
+    assert.strictEqual(r.hardware_gewinn, 60);
+});
+
+test('hardware ignored when hardware string is empty', () => {
+    const r = calculate(baseInput({
+        schaltung: { hardware: '', hardware_ek: 40, kundenverkaufspreis_netto: 100 },
+    }));
+    assert.strictEqual(r.shop.betrag, 100);
+});
+
+test('employee fix rule wins regardless of percent fallback', () => {
+    const r = calculate(baseInput({
+        tarifRule: {
+            provision_typ: 'fix', betrag: 100, basis_euro: null,
+            verkaeufer_provision_typ: 'fix', verkaeufer_provision_betrag: 15,
+        },
+    }));
+    assert.strictEqual(r.shop.betrag, 100);
+    assert.strictEqual(r.mitarbeiter.betrag, 15);
+});
+
+test('employee percent rule uses shop commission as base', () => {
+    const r = calculate(baseInput({
+        tarifRule: {
+            provision_typ: 'fix', betrag: 200, basis_euro: null,
+            verkaeufer_provision_typ: 'prozent', verkaeufer_provision_betrag: 10,
+        },
+    }));
+    assert.strictEqual(r.shop.betrag, 200);
+    assert.strictEqual(r.mitarbeiter.betrag, 20);
+});
+
+test('employee falls back to anbieter percentage when rule has no employee fields', () => {
+    const r = calculate(baseInput({
+        tarif: { provision_euro: 100 },
+        mitarbeiterProzentsatz: 8,
+    }));
+    assert.strictEqual(r.shop.betrag, 100);
+    assert.strictEqual(r.mitarbeiter.betrag, 8); // 8% of 100
+});
+
+test('rounding produces 2-decimal numbers', () => {
+    const r = calculate(baseInput({
+        anbieterRule: { provision_typ: 'prozent', betrag: 33.33, basis_euro: 100 },
+    }));
+    assert.strictEqual(r.shop.betrag, 33.33);
+});
+
+test('full scenario: tariff rule + tarifoptionen + hardware + employee %', () => {
+    const r = calculate({
+        schaltung: { hardware: '111111111111111', hardware_ek: 50, kundenverkaufspreis_netto: 80 },
+        tarif: { provision_euro: 0 },
+        tarifRule: {
+            provision_typ: 'fix', betrag: 200, basis_euro: null,
+            verkaeufer_provision_typ: 'prozent', verkaeufer_provision_betrag: 10,
+        },
+        anbieterRule: null,
+        tarifoptionen: [{ name: 'Aktion', provision_euro: 25 }, { name: 'Rabatt', provision_euro: -45 }],
+        mitarbeiterProzentsatz: 0,
+    });
+    // shop = 200 + (25 - 45) + (80 - 50) = 200 - 20 + 30 = 210
+    assert.strictEqual(r.shop.betrag, 210);
+    // employee = 10% of 210 = 21
+    assert.strictEqual(r.mitarbeiter.betrag, 21);
+});