fix(dev): Vite-API-Proxy, Auth, Stripe-Mails und Backend-Erweiterungen

- Client: API-Basis-URL (joinApiUrl, /v1-Falle), Vite strictPort + Proxy 127.0.0.1, Nicht-JSON-Fehler

- Server: /api-404 ohne Wildcard-Bug, SPA-Fallback, Auth-Middleware, Cron, Mailer, Crypto

- Routen: OAuth-State, Email/Stripe/Analytics; client/.env.example

Made-with: Cursor

server/config/index.mjs

@@ -76,6 +76,9 @@ export const config = {
     autoSchedule: false, // manual only
   },
 
+  /** Highest product tier (admin comped plan, PLANS key in stripe.mjs). Optional env: TOP_SUBSCRIPTION_PLAN */
+  topSubscriptionPlan: (process.env.TOP_SUBSCRIPTION_PLAN || 'business').trim().toLowerCase(),
+
   // Admin: comma-separated list of emails with admin rights (e.g. support)
   adminEmails: (process.env.ADMIN_EMAILS || '')
     .split(',')
@@ -87,6 +90,9 @@ export const config = {
     webhookSecret: process.env.GITEA_WEBHOOK_SECRET || '',
     webhookAuthToken: process.env.GITEA_WEBHOOK_AUTH_TOKEN || process.env.GITEA_WEBHOOK_SECRET || '',
   },
+
+  /** HMAC secret for Gmail/Outlook OAuth state (recommended in production) */
+  oauthStateSecret: process.env.OAUTH_STATE_SECRET || '',
 }
 
 /**