Security & UX Release v7

Security:
- H1: Stored-XSS-Fix — Upload-Pfad-Whitelist (Server + Frontend-Guard safeFileUrl)
- H2: Transaktionen repariert — txDb-Contract in db.js (PG + SQLite), Rollback funktioniert
- H3-Vorbereitung: SESSION_SECRET wird in Compose durchgereicht (Fix M3)
- registerLimiter exportiert (Crash-Bug: Route.post ohne Callback)
- LDAP-Sync: PG-Transaktionsabbruch bei UNIQUE-Verstoß behoben (Precheck-Selects)
- LDAP-Filter: nur echte Benutzerkonten (keine Computer/Service-Accounts, Bit 512)
- Rollen app-seitig: Sync ändert nie role/status, neue User immer user+inaktiv
- DB-Cleanup: 82 Computer-/Service-Accounts aus lokaler User-Tabelle entfernt

UX:
- Dashboard: Vorlagen als Table-Liste + Column-Chart (Top 5 in %), 2 gleich große Spalten
- Table-Listen (Dashboard/Vorlageneditor/Aufgaben) scrollbar bis Seitenende
- Pagination 10/Seite im Dashboard, Sidebar-Label Dashboard

backend/migrations.js

@@ -196,6 +196,28 @@ async function initDatabase() {
     }
   }, 60 * 60 * 1000);
 
+  // H4: uploads table — track file ownership for authorization on download
+  await migrate('add_uploads_table', isPostgres
+    ? `CREATE TABLE IF NOT EXISTS uploads (
+        id SERIAL PRIMARY KEY, filename TEXT UNIQUE NOT NULL, user_id INTEGER NOT NULL,
+        original_name TEXT, size INTEGER, created_at TIMESTAMP DEFAULT NOW(),
+        FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+      )`
+    : `CREATE TABLE IF NOT EXISTS uploads (
+        id INTEGER PRIMARY KEY AUTOINCREMENT, filename TEXT UNIQUE NOT NULL, user_id INTEGER NOT NULL,
+        original_name TEXT, size INTEGER, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+      )`
+  );
+  await migrate('idx_uploads_filename', isPostgres
+    ? `CREATE INDEX IF NOT EXISTS idx_uploads_filename ON uploads(filename)`
+    : `CREATE INDEX IF NOT EXISTS idx_uploads_filename ON uploads(filename)`
+  );
+  await migrate('idx_uploads_user_id', isPostgres
+    ? `CREATE INDEX IF NOT EXISTS idx_uploads_user_id ON uploads(user_id)`
+    : `CREATE INDEX IF NOT EXISTS idx_uploads_user_id ON uploads(user_id)`
+  );
+
   console.log('Datenbanktabellen initialisiert.');
 }