DEV1.0: Initial commit - Workflow Portal with security fixes

- Backend: Express.js + PostgreSQL/SQLite with LDAP/AD integration
- Frontend: React 18 + Vite + TailwindCSS/DaisyUI
- Security fixes applied (2026-07 + 2026-08):
  - LDAP injection prevention, CSRF protection, HttpOnly cookies
  - Session hashing (SHA-256), account lockout, rate limiting
  - Input validation (zod), file upload security, CSP/HSTS headers
  - V3: express-rate-limit updated (ip-address SSRF fix)
  - V4: postcss updated (nanoid DoS fix)
  - V5: Rate-limit on /health endpoint
  - V6: Session rotation on login (session fixation prevention)
  - V9: Task values array limit (DoS prevention)
  - V10: Frontend XSS audit completed
- Docker: Multi-stage build, non-root user, PostgreSQL + backup service

backend/middleware/rateLimit.js

@@ -0,0 +1,46 @@
+/**
+ * Rate limiting configuration module.
+ * 
+ * Punkt 23: User-level rate limiting for critical endpoints.
+ */
+const rateLimit = require('express-rate-limit');
+
+// General API rate limit: 100 requests per minute per IP
+const apiLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 100,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Zu viele Anfragen. Bitte später erneut versuchen.' },
+});
+
+// Login rate limit: 5 attempts per minute per IP (brute-force protection)
+const loginLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 5,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Zu viele Anmeldeversuche. Bitte in 1 Minute erneut versuchen.' },
+});
+
+// Punkt 23: Task creation rate limit: 20 per minute per user
+const taskCreateLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  skip: (req) => !req.user,
+  message: { error: 'Zu viele Auftragsanfragen. Bitte später erneut versuchen.' },
+});
+
+// Punkt 23: File upload rate limit: 10 per minute per user
+const uploadLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  skip: (req) => !req.user,
+  message: { error: 'Zu viele Upload-Anfragen. Bitte später erneut versuchen.' },
+});
+
+module.exports = { apiLimiter, loginLimiter, taskCreateLimiter, uploadLimiter };