Sicherheits-Fixes, toter Code entfernt, Optimierungen

Sicherheit:
- CSRF-Schutz auf allen API-Routes (admin, proposals, files, stats, export)
- authenticateToken vor csrfProtection bei admin/proposals (CSRF-Bypass behoben)
- CORS eingeschränkt auf taskmate.aegis-sight.de
- JWT_SECRET und SESSION_TIMEOUT nicht mehr exportiert
- Tote Auth-Funktionen entfernt (generateCsrfToken, generateToken Legacy)

Toter Code entfernt:
- 6 ungenutzte JS-Dateien (tour, dashboard, 4x contacts-*)
- 2 ungenutzte CSS-Dateien (dashboard, contacts-extended)
- backend/migrations/ Verzeichnis, knowledge.js.backup
- Doppelter bcrypt require in database.js

Optimierung:
- Request-Logging filtert statische Assets (nur /api/ wird geloggt)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/server.js

@@ -82,7 +82,7 @@ app.use(helmet({
 
 // CORS
 app.use(cors({
-  origin: true,
+  origin: process.env.CORS_ORIGIN || 'https://taskmate.aegis-sight.de',
   credentials: true
 }));
 
@@ -97,14 +97,15 @@ app.use(cookieParser());
 const { sanitizeMiddleware } = require('./middleware/validation');
 app.use(sanitizeMiddleware);
 
-// Request Logging
+// Request Logging (nur API-Requests, keine statischen Assets)
 app.use((req, res, next) => {
-  const start = Date.now();
-  res.on('finish', () => {
-    const duration = Date.now() - start;
-    // Use originalUrl to see the full path including /api prefix
-    logger.info(`${req.method} ${req.originalUrl} ${res.statusCode} ${duration}ms`);
-  });
+  if (req.originalUrl.startsWith('/api/')) {
+    const start = Date.now();
+    res.on('finish', () => {
+      const duration = Date.now() - start;
+      logger.info(`${req.method} ${req.originalUrl} ${res.statusCode} ${duration}ms`);
+    });
+  }
   next();
 });
 
@@ -140,18 +141,18 @@ app.use('/api/tasks', authenticateToken, csrfProtection, taskRoutes);
 app.use('/api/subtasks', authenticateToken, csrfProtection, subtaskRoutes);
 app.use('/api/comments', authenticateToken, csrfProtection, commentRoutes);
 app.use('/api/labels', authenticateToken, csrfProtection, labelRoutes);
-app.use('/api/files', authenticateToken, fileRoutes);
+app.use('/api/files', authenticateToken, csrfProtection, fileRoutes);
 app.use('/api/links', authenticateToken, csrfProtection, linkRoutes);
 app.use('/api/templates', authenticateToken, csrfProtection, templateRoutes);
-app.use('/api/stats', authenticateToken, statsRoutes);
-app.use('/api/export', authenticateToken, exportRoutes);
+app.use('/api/stats', authenticateToken, csrfProtection, statsRoutes);
+app.use('/api/export', authenticateToken, csrfProtection, exportRoutes);
 app.use('/api/import', authenticateToken, csrfProtection, importRoutes);
 
-// Admin-Routes (eigene Auth-Middleware)
-app.use('/api/admin', csrfProtection, adminRoutes);
+// Admin-Routes
+app.use('/api/admin', authenticateToken, csrfProtection, adminRoutes);
 
-// Proposals-Routes (eigene Auth-Middleware)
-app.use('/api/proposals', csrfProtection, proposalRoutes);
+// Proposals-Routes
+app.use('/api/proposals', authenticateToken, csrfProtection, proposalRoutes);
 
 // Notifications-Routes
 app.use('/api/notifications', authenticateToken, csrfProtection, notificationRoutes);