Geheimer Vorschau-Link: /vorschau/<subdomain>/<token> setzt ein Cookie nur fuer diese Preview

- websiteProjects.shareToken (scripts/vorschau-link-setup.mjs)
- POST/DELETE /api/admin/website-projects/:id/vorschau-link fuer Mitarbeiter (neu erzeugen / abschalten)
- GET /api/vorschau-link/pruefen fuer die Login-Pruefung der Previews (preview-portal /auth/verify)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/vorschau-link-setup.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/**
+ * Geheimer Vorschau-Link (2026-10-26): legt websiteProjects.shareToken an.
+ * Idempotent: ein vorhandenes Attribut wird uebersprungen.
+ * Usage:
+ *   node scripts/vorschau-link-setup.mjs --check   (nur melden, nichts anlegen)
+ *   node scripts/vorschau-link-setup.mjs           (fehlendes Attribut anlegen)
+ */
+import { pathToFileURL } from 'node:url'
+import { createAppwriteClient } from './preview-runner-setup.mjs'
+
+export const VORSCHAU_LINK_ATTRIBUTES = [{ key: 'shareToken', type: 'string', size: 64, required: false }]
+
+export async function main({ check = false, client, log = console.log } = {}) {
+  const api = client || createAppwriteClient()
+  const existing = new Set((await api.listAttributes()).map((a) => a.key))
+  const missing = VORSCHAU_LINK_ATTRIBUTES.filter((a) => !existing.has(a.key))
+  for (const attr of VORSCHAU_LINK_ATTRIBUTES) {
+    if (existing.has(attr.key)) log(`= Attribut ${attr.key} (existiert)`)
+    else if (check) log(`- Attribut ${attr.key} FEHLT`)
+  }
+  if (check) {
+    log(missing.length ? `${missing.length} Attribut(e) fehlen.` : 'Alle Attribute vorhanden.')
+    return { missing }
+  }
+  for (const attr of missing) {
+    await api.createAttribute(attr)
+    log(`+ Attribut ${attr.key}`)
+  }
+  for (const attr of missing) await api.waitForAttribute(attr.key)
+  log('Fertig.')
+  return { missing }
+}
+
+const invokedDirectly = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href
+if (invokedDirectly) {
+  const check = process.argv.includes('--check')
+  main({ check })
+    .then(({ missing }) => process.exit(check && missing.length ? 1 : 0))
+    .catch((e) => {
+      console.error(e.message)
+      process.exit(1)
+    })
+}