fix(dev): Vite-API-Proxy, Auth, Stripe-Mails und Backend-Erweiterungen

- Client: API-Basis-URL (joinApiUrl, /v1-Falle), Vite strictPort + Proxy 127.0.0.1, Nicht-JSON-Fehler

- Server: /api-404 ohne Wildcard-Bug, SPA-Fallback, Auth-Middleware, Cron, Mailer, Crypto

- Routen: OAuth-State, Email/Stripe/Analytics; client/.env.example

Made-with: Cursor

server/routes/analytics.mjs

@@ -8,9 +8,12 @@ import { asyncHandler, ValidationError } from '../middleware/errorHandler.mjs'
 import { respond } from '../utils/response.mjs'
 import { db, Collections } from '../services/database.mjs'
 import { log } from '../middleware/logger.mjs'
+import { requireAuth } from '../middleware/auth.mjs'
 
 const router = express.Router()
 
+router.use(requireAuth)
+
 // Whitelist of allowed event types
 const ALLOWED_EVENT_TYPES = [
   'page_view',
@@ -79,7 +82,6 @@ function stripPII(metadata) {
 router.post('/track', asyncHandler(async (req, res) => {
   const {
     type,
-    userId,
     tracking,
     metadata,
     timestamp,
@@ -88,6 +90,8 @@ router.post('/track', asyncHandler(async (req, res) => {
     sessionId,
   } = req.body
 
+  const userId = req.appwriteUser.id
+
   // Validate event type
   if (!type || !ALLOWED_EVENT_TYPES.includes(type)) {
     throw new ValidationError(`Invalid event type. Allowed: ${ALLOWED_EVENT_TYPES.join(', ')}`)